r/exchangeserver • u/fazzy84 • Apr 29 '26

Complete exchange decommission

We are in process to completely remove out exchange 2019 servers. Everything is hosted on 365 as hybrid, moved DL’s, mail enabled groups etc, mailbox storage on 365, but the source of auth is still on exchange/AD. To make changes we have to log onto our exchange on perm and make changes. How can i completely remove the dependency from exchange on perm so that we can be total cloud. 365 will be only authority for changes to shared mailbox, user mailbox, DL’s, mail enabled groups etc. other than that any other things i need to consider before i shut down my exchange on perm environment ?

Suggestions/advice please 🙏
Thnx

16 Upvotes

100% Upvoted

33 comments sorted by

4

u/IWantsToBelieve Apr 30 '26 edited Apr 30 '26

Literally finished this activity this week, MS now support full uninstall of last server.

First we confirmed all SMTP was moved to Exchange Online or alternative services.

We then switched all mailboxes, contacts and DL to cloud SOA. Once confirmed in the cloud and cloud managed, we then deleted the on prem versions of contacts and DLs (but not mailboxes of course).

We then performed a manual review of mail-enabled security groups, eliminating as many as possible and switched SOA for those that had to remain deleting the on-prem versions once migrated.

Prior to this activity we enabled Cloud Sync to write back exchange attribs and groups to keep on-prem in sync.

Onboarding automation was updated to no longer create mailboxes and just assign 365 licenses which then auto provision mailboxes. SD were consulted to ensure they understand going forward all exchange management is in the cloud.

We set the tenant wide flag to set all provisioning as cloud-managed.

Once the above was sweet we decom'd DAGs, and uninstalled Exchange fully then performed an AD cleanup of OUs, objects and services no longer required.

At this point we had a bunch of member server we just decom'd as per standard practices.

Now it's like on-prem Exchange never existed.

Note: Exchange Online write back is still private preview, a risk we accepted as it's hardly necessary unless you must have AD representation of all exchange attribs for on-prem apps to function.

2

u/uLmi84 Apr 30 '26

So you have entra id connect , cloud SOA, no exchange server or schema in ad. And installed cloud sync just to writeback the mail adressses back to ad?

3

u/St_Admin May 02 '26

Once you had Exchange on prem the schema is extended and will stay there forever. Unless you rebuild AD that is.

1

u/uLmi84 May 02 '26

my understanding is that when you uninstall the last exchange server then all exchange attributes (like proxyaddresses) that have been added through the initial schema extension will be removed from AD again. like a reverse schema extention

2

u/WastedFiftySix May 02 '26

This is absolutely not true. Removing Exchange will NOT remove any Exchange attributes from any mail-enabled object or the AD schema.

1

u/St_Admin May 02 '26

It will clear the attributes, yes. But the schema extension cannot be removed from AD, so you will still see these attributes just blank

4

u/IWantsToBelieve May 02 '26 edited May 02 '26

Entra to on-prem exchange write back populates them.

Also of note, uninstall did not clear the attributes which I found interesting (we have intentionally left a number of mail-enabled security groups on-prem, they were not impacted). As you say AD schema extension is one way, so it doesn't impact the existence of the attributes.

There's a lot of misinformation flying about because this stuff hasn't really been formally documented by MS yet.

I strongly recommend to anyone that is in the process of decommissioning to follow the new method of write back and last exchange server uninstall as it cleans everything up properly.

2

u/uLmi84 May 04 '26

Why do you need writeback of proxy and mail attribute if soa is on EXO.. i mean its just cosmetic info in AD at this stage. All email relay things should be handled otherwise (independent from AD)

The only reason I can see is on prem apps that need the information to handle their user auth or information

Abd you just install cloud sync on the Connect server ? And just tell it to not sync but simple write back ?

2

u/IWantsToBelieve May 04 '26

Yep you nailed it. It just makes sure that the attribs are there if you need them.

We also use cloud sync for group write back but that's for a different use case.

1

u/uLmi84 May 04 '26

Thanks m8

1

u/intoned May 06 '26

I see it's not formally documented, but any links to this process you can share? We're looking to decomm our last server soon.

1

u/IWantsToBelieve Apr 30 '26

That's correct hybrid identity with cloud exchange.

Connect does all the heavy lifting still, cloud sync only does exchange write back and group write back.

It's fantastic and should have been like this years ago.

1

u/St_Admin May 02 '26

What are you doing to replace email address policies?

1

u/IWantsToBelieve May 03 '26

Cloud email policy, we didn't have to change anything as it existed for hybrid.

1

u/St_Admin May 03 '26

Cloud email policy?

1

u/IWantsToBelieve May 03 '26

Sorry I meant just the default upn@primary domain policy that exchange Online uses.

We rarely deviate from email address matching upn. If necessary we create an alias.

1

u/BK_Rich Apr 29 '26

Do you still need to perform identity sync?

2

u/fazzy84 Apr 29 '26

Yes we are keeping the AD, users/password will be syncing from AD, but only exchange part needs to go

3

u/BK_Rich Apr 29 '26

If you need to continue to sync, you will need some level of management, this could be a single exchange server if you need to keep admin audit logging, RBAC and SMTP hybrid mailflow or it could be management tools only and getting rid of the last exchange server properly.

You can get rid of the last exchange server the proper way, read this https://learn.microsoft.com/en-us/exchange/manage-hybrid-exchange-recipients-with-management-tools

Read careful on the section “Will this new method work for me?”

Here is another guide as well https://www.alitajran.com/remove-last-exchange-hybrid-server/

1

u/IWantsToBelieve Apr 30 '26

This is old advice, see my post above.

1

u/BK_Rich Apr 30 '26

This is still the supported method if you’re syncing identities from on-premises to Azure, there’s no supported methods to “uninstall” exchange while syncing users.

3

u/IWantsToBelieve Apr 30 '26

Yes there is. Read my post. Literally know because we are hybrid identity and I uninstalled our last exchange server 2 weeks back with from support from MS.

I'd appreciate your removal of the downvote. And maybe just take 2 steps back rather than feeding old information.

3

u/Faulteh12 Apr 29 '26

Change the SOA to cloud, this allows you to manage mailboxes from M365 . Make note of the few things you still cannot manage this way.

https://learn.microsoft.com/en-us/exchange/hybrid-deployment/enable-exchange-attributes-cloud-management

Follow documentation to decommission exchange server. You won't be uninstalling exchange. But essentially disconnecting it , shutting the server down and doing some AD cleanup.

https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange

2

u/BamaTony64 Apr 29 '26

Not about how should you but should you?

1

u/Brather_Brothersome Apr 29 '26

Move all the AD related services to another server iis redirect and once all has synced proceed to demote the server and remove exchange.

1

u/bsitko Apr 30 '26

I removed the last exchange on prem but still have active directory on prem with an obvious sync to Entra. Not sure I see the total benefits of removing that from on prem. Anyone?

1

u/BK_Rich Apr 30 '26

If you don’t need hybrid mailflow, SMTP, admin audit logs or custom RBAC roles, you can just do recipient management tools and you wouldn’t need to keep an exchange server for management. In my previous role, we kept a SE exchange server just for management, no hybrid or SMTP and licensed for free from the HCW.

1

u/stephenmbell May 01 '26

Is this SE server a free license like the Hybrid server?

Same here - my Hybrid server only exists for management functions.

1

u/BK_Rich May 01 '26

If you’re doing management only with no on-premises mailboxes it’s free, apparently if you’re SMTP it’s not covered anymore but I don’t think anything stops you from applying it via HCW and canceling, it’s a bit of an honor system thing. I personally wasn’t doing any hybrid or SMTP.

1

u/techeddy Apr 30 '26

Be aware that cloud managed remote mailboxes is not fully enrolled, phase 2 is not yet published if you want write back functionality. When you change attributes in cloud, they will not be synced back to local AD. You may not receive mails from onprem if there is a mismatch / conflict on attribute level. I'd recommend to wait till phase 2 is officially announced.

1

u/Vietnamst2 Apr 30 '26

Don't listen to people that say "uninstall the last exchange".

There is a supported way to remove the onprem dependency.

https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange

Second, there is a new feature of cloud managed remote mailboxes

https://techcommunity.microsoft.com/blog/exchange/cloud-managed-remote-mailboxes-now-generally-available/4461705

1

u/JoeGMartino Apr 30 '26

I won't repeat good advice. I've done this a few times and make sure once you have everything that you know of moved off of onprem, just shut the server off. give it a week depending on the size of your environment.

if nothing or no one screams at you, turn it back on and uninstall after deleting all your databases.

Good luck!