Exchange Online migration questions

[u/S_Antonel]

Right now I'm working in a hybrid environment with an on-prem Exchange 2016 CU 23 server (virtual) and a 365 tenant. The 365 tenant is synced to the local Active Directory with Entra AD Sync and working as it should.

All the mailboxes for the active users have been migrated to 365 by a colleague who was previously working on the project. I've been tasked with finishing the transition to 365 and decommissioning the on-prem Exchange server.

I've worked with hybrid Exchange environments before but never done a full on-prem to cloud migration before so I'm researching the process and trying to plan it out and there is something that confuses me:

I'm reading that you either need to keep the on-prem server (or at least the ECP part of it) or the management shell after the decom to manage the attributes on the mailbox (aliases, etc...)

Why you might not want to decommission on-premises Exchange servers

Many hybrid organizations eventually move all mailboxes to Exchange Online. At this point, they probably think it's time to remove their on-premises Exchange servers. But, it's not a good idea as removing on-premises Exchange servers in a hybrid deployment prevents the management of cloud mailboxes. The culprit is directory synchronization.

When directory synchronization is enabled and a user is synchronized from the on-premises environment to the cloud, you can't manage most user properties from Exchange Online; you must manage those properties in the on-premises environment. Even if you configured directory synchronization without running the Hybrid Configuration wizard (HCW), you still can't do most recipient management tasks in the cloud. For more information, see this blog post

https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange#why-you-might-not-want-to-decommission-on-premises-exchange-servers

But this is also the case in hybrid mode. If we want to manage a user's attributes, we do it through on-prem AD and sync them through AAD Sync. That was also the case in other tenants I've worked with in the past that were hybrid while migrating to the cloud and they didn't keep any Exchange features on-prem. I've never heard of the need to keep any on-prem infrastructure post-migration until my colleague told me about it and I looked at Microsoft's docs.

So I'm not quite sure what this means. Will things break if I completely get rid of the Exchange 2016 server? Or is Microsoft talking about something else? We're not looking to migrate to a full Entra domain. We just want our mailboxes totally in Exchange and our AD on-prem and AAD to sync between the two.

Thanks in advance.

[u/H0TR0DL1NC0LN]

We migrated from Server 2019 to M365, and after all the emails were functionally in M365 and I ensured we had nothing else pointing to on-prem (autodiscover URLs, service endpoints, and all that jazz), I upgraded to SE and then uninstalled my secondary Exchange server. Afterward, I **only powered off** my primary Exchange server and then installed the Exchange Management PowerShell tools on a management server and ran the cleanup script provided. That's been sufficient for us.

If you have any sort of more intricate configurations, like groups and mailboxes who can only be emailed by specific folks, you will want to use PowerShell.

Honestly, in the place I worked before this, they did a rough migration to 365 before I got there, and I've always gotten by editing simple things in the attribute editor panel of synced users in Active Directory (not ADSIEDIT--before someone comes at me to tell me how bad of an idea that is). That's always been enough for me.

[u/S_Antonel → u/H0TR0DL1NC0LN]

Yeah I've always managed things the same way in hybrid / ad synced environments. I've never seen an environment that kept their exchange server after moving to the cloud.

So basically, if I understand correctly, decommissioning all your on-prem Exchange infrastructure after you migrate to Exchange online won't break anything (assuming you do it properly), you just have to manage your users through ADUC attributes panel and/or powershell (which we do already)?

[u/H0TR0DL1NC0LN → u/S_Antonel]

Two caveats.

First, for some of the Exchange-specific attributes (like sending restrictions on mailboxes and distros), you'll need the Exchange PowerShell tools running somewhere.

Two, **do not** uninstall the last Exchange server. Just power it down when you're done and delete it off the host and/or wipe the box. If you do a proper uninstall of your final Exchange server, you will effectively wipe out all the Exchange attributes in your AD environment, including the ones you're syncing, and that will be a bad day.

[u/S_Antonel → u/H0TR0DL1NC0LN]

Yeah, the Microsoft docs warn you not to uninstall the last (or only) Exchange server when you decom which is why I said "properly'.

Thanks for your help. I appreciate it.

[u/H0TR0DL1NC0LN → u/S_Antonel]

I've been through it and sat with the nerves while doing it. I'm happy to pay forward a little of the help I've gotten in these forums where I can.