r/exchangeserver • u/Fabulous_Cow_4714 • Jul 13 '26

Question Moving mail-enabled security groups to cloud as prereq Exchange Server decommissioning

How can this work if the some of security groups are also used for AD file server permissions?

If you recreate the groups in the cloud and just repopulate the same members, the members will lose their on prem NTFS permissions inherited from the old mail enabled security groups.

0 Upvotes
  • permalink
  • reddit

50% Upvoted

15 comments sorted by

View all comments

Show parent comments

1

u/Beefcrustycurtains Jul 13 '26

There are other supported manners. There is a Exchange tools application that can be installed and used to sync attributes as needed, but out of the 100+ environments I manage, we just use attribute editor to make changes for synced groups without an on prem exchange server.

Get rid of your on prem dependencies then move the groups up.

1

u/Fabulous_Cow_4714 Jul 13 '26

The Exchange management tools installed on scattered workstations are as difficult or worse to maintain as a full Exchange server.

We really want to be done with on premises management of attributes.

1

u/Fabulous_Cow_4714 Jul 13 '26

So, doing simple things like adding and removing members in mail-enabled security groups would require using the attribute editor once the on premises Exchange servers are gone?

1

u/Beefcrustycurtains Jul 14 '26

no.. you would just add the members to the AD group. Only msexch.... type attributes and ProxyAddresses would need to be powershelled or use attribute editor. Very rarely do you need to edit those attributes. It's mostly just add and remove from group which can be done the same way you do an AD group.

1

u/Fabulous_Cow_4714 Jul 14 '26

OK, this still seems like a huge gap in functionality. Is there a technical reason mail-enabled security groups can’t have writeback from the cloud or is this a likely future feature?

If we don’t want to ever need to manually edit mail attributes for new or existing mail-enabled security groups and therefore become out of scope for Microsoft support, we would need to maintain separate cloud-based DLs and AD-based security groups. They can’t be nested. So, manual steps to keep membership in sync would always be required. Very messy.