Remove Exchange Hybrid (supported)

-

How and when to decommission your on-premises Exchange servers in a hybrid deployment | Microsoft Learn

I provide you the link and a simple answer


Running Exchange Online ONLY with Active Directory (Entra ID Connect):

NOTE:
You do NOT need a running Exchange Server on-premises, but the NEW Exchange Management Tools

  1. Move the LAST Exchange Server onto a Virtual Machine
  2. ShutDown the VM and archive the Exchange VM
  3. Delete the VM
  4. executing CleanupActiveDirectoryEMT.ps1 is optional (if you would need an Exchange Server later, you can re-deploy with \ADPrep)
  5. Install the NEW Exchange Management Tools on any Windows Machine you need
    (Windows 11 is supported for Exch Mgmt Tools)
  6. do NOT modify Entra ID Connect, leave all Exchange hybrid configurations inplace

(if you like to fully remove Exchange On-Premises, you can do so, but you must modify Entra ID Connect msExch attribs not to be sync'ed at all. Your users must be managed locally and you need to set the mail and proxy Address manually in your AD and sync it to Entra ID)


Note

It's recommended that you leave the Exchange Hybrid Deployment feature enabled in cloud sync or Microsoft Entra Connect. 


Microsoft documentation:

Removing Your Last Exchange Server FAQ | Microsoft Community Hub

Exchange Server supportability matrix | Microsoft Learn

How and when to decommission your on-premises Exchange servers in a hybrid deployment | Microsoft Learn

Comments

Post a Comment

Popular posts from this blog

How to hide users from GAL if they are AD Connect synchronized

-
Image
How to hide and un-hide users from Global Address List (GAL) in Exchange Online if they are AD Connect synchronized Hiding User from GAL isn't possible if those are synchronized form On-Premises Active Directory. The local AD is the leading system for all important attributes, like SMTP, UPN and hiding from GAL. Especially during a cross-tenant migration, you do not want to see not migrated user in the GAL. Those User aren't actively working until their cut-over day. Since the Exchange Online attribute  msExchHideFromAddressList s is an AD on-premises parameter, we have two possible ways hiding user in BME from GAL.   Modify the AD Connect for your teant with a custom rule, by using a extensionAttribute to set the HidefromGAL. In this rule, for users which have an entry in the extensionAttribute, hiding / un-hiding will be controlled by AD Connect This is the best option for Cross-Tenant Migration, if you run 2 or more AD Connect system We direct modif...
Read more

Exchange x500 address x500:/o=ExchangeLabs

-
Image
 You have Exchange Hybrid in place. Now you wonder about an address with you see on-premises with all users. This address has the following format: x500:/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOxxxxxx)/cn=Recipients/cn=234xxxx This address is now found in the Exchange proxyAddresses in On-Premises as well as in Entra ID. Additionally you will see them in msExchShadowProxyAddresses The ExchangeLabs is Microsoft internal Exchange Online Organization and therefore needed. This x500 address is created in Exchange Online and sync'ed via Azure AD Connect (Entra ID Connect) back on-premises. If you delete this address on-premises, the connection between will sync this Cloud leading attribute back to on-premisses. If you have multiple Domains and Active Directories connected to your Tenant, this x500 address from your tenant will be added to ALL users. Also to users which are from an local AD without Exchange / Exchange Hybrid. As long AAD Connect/ Entra ID Connect will...
Read more

MFA with Guest Access and different tenants settings

-
Image
There is an update regarding MFA Multi Factor Authentication. If you are guest with a different Tenant, the MFA Settings are now reflecting the settings of all tenants in a different way. Each MFA setting is reflected and you can setup your MFA device as per tenant and the admin settings allow. Login to your Profile in Office 365/ Azure AD: https://account.activedirectory.windowsazure.com/r/#/profile or https://myapps.microsoft.com Go to your PROFILE: Sign in to https://myapps.microsoft.com Select your account name in the top right, then select profile. Select Additional security verification. If might be happen, your admin hast configured MFA, so you wouldn't see this menu. Simply switch the tenant to the guest tenant where you need to configure MFA. Once you go back to your profile and you will find the MFA device and other settings a usual:
Read more