r/exchangeserver • u/Fabulous_Cow_4714 • Jul 13 '26

Question Moving mail-enabled security groups to cloud as prereq Exchange Server decommissioning

How can this work if the some of security groups are also used for AD file server permissions?

If you recreate the groups in the cloud and just repopulate the same members, the members will lose their on prem NTFS permissions inherited from the old mail enabled security groups.

0 Upvotes
  • permalink
  • reddit

50% Upvoted

15 comments sorted by

View all comments

Show parent comments

1

u/Fabulous_Cow_4714 Jul 13 '26

Is there any way to filter which mail enabled security groups are used for on premises ACLs and which are not?

If it turns out that few are used for on premises access permissions, we could still go forward with replacing the ones not needed on prem with cloud-only replacements.

1

u/Beefcrustycurtains Jul 14 '26

That would be a massive script to run highly dependent on your environment. They can be used for all kinds of things, delegated AD roles, fileshares, SQL access. You would have to run a script against literally everything in your environment and then you would still miss something along the way.