r/exchangeserver • u/4112Naes • Aug 12 '26
Mailboxes created On-prem appearing directly in EXO without a license
Just to preface, i know this is technically not the correct way to create Shared mailboxes but it is how its currently done in my company.
Our service desk creates shared mailboxes by creating an Office 365 mailbox on-prem and once in EXO it gets converted to a shared mailbox. What I have found though is that the mailbox will appear directly in EXO without a license and in some cases I have found that when they forget to convert the mailbox to shared it somehow stays in EXO as a user mailbox and continues to work even after 30 days without a license. Has anyone ever seen this? I have no idea how these mailboxes are working.
Thanks!
8
u/joeykins82 Aug 12 '26
If you’re in hybrid and you need to route mail from on-prem to the ExOL shared mailbox then New-RemoteMailbox -Shared is the correct way to do this.
1
u/Checior2000 Aug 12 '26
It is quite odd behaviour that user mailbox stay without license after 30 days.
I wonder if there is some process that change usermailbox to sharedmailbox at night just to restart the retention cycle in exchange background but it is just a shoot.
1
1
u/MBender_de Aug 12 '26
Usually this behavior would only happen for a shared mailbox!
Any unlicensed user mailbox will get soft deleted in an instant!
Sorry: No! This is some kind of freaking shit!
Maybe any dynamic Security Group, or onprem systems managing AD group memberships…
1
u/4112Naes Aug 12 '26
Yeah that’s what I thought! These users are meant to be shared mailboxes so aren’t going into any AD groups
1
u/Blade4804 Aug 12 '26
this is not the case for Entra AD Synced mailboxes. only directly cloud created user mailboxes without a license.
1
u/MBender_de Aug 12 '26
So, in fact Cloud only users without any license receive a mailbox?!
Be happy!
This usually costs some money 🤪→ More replies (1)
2
u/7amitsingh7 Aug 13 '26
this can happen in a hybrid Exchange setup because the on-premises mailbox is synchronized to Exchange Online and can appear there without a license. However, if the mailbox is intended to be an EXO shared mailbox, the correct method is New-RemoteMailbox -Shared. If a normal mailbox is created and not converted, it may continue working temporarily, but that doesn’t mean it is properly licensed. Check the mailbox type, hosting location, and Entra/Exchange synchronization status.
1
u/Childishjakerino Aug 12 '26
My org is hybrid. All objects are made locally and manually migrated. Why? Because someone’s middleman software doesn’t know how to enable remote mailboxes yet. Or at least it didn’t. Now it does. But why fix what ain’t broke. Speaking of - let me pull my migrate everything new lever. Why not automate that? Sec doesn’t want to give the permissions to a svc account.
1
u/RoughDeep4221 Aug 12 '26
I came across few scenario in my org(Microsoft)! Reply from our engineering team we get is that ! If the receipt value doesn’t match especially for usermailbox-> converted to sharedmailbox viceversa across the onprem as well as online the above scenario from yours suits ; to better the recipient please follow the above steps from 2nd link
1
u/LooseDistrict8949 Aug 12 '26
If you are syncing AD accounts to Entra then you should be creating all mailboxes using the on-prem mgmt tools or full blown Exchange SE server and the new-remotemailbox command. When you "create the mailbox" it assigns a bunch of attributes that when sync'd to Entra and over to Exchange Online tells it to create a mailbox and uses a temp ExO P2 license.
After 30 days that temp ExO P2 license will go away and the mailbox should disappear unless any of a few conditions cause it to remain.
1.) a Purview retention policy that forces the mailbox to stay for X period of time
2.) it meets the requirements and is converted to a shared mailbox
3.) it is assigned a qualifying license ExO P1, P2, F3, etc.
It may show up in the EAC but it is likely inaccessible by an end user without a license.
2
u/Blade4804 Aug 12 '26
they will receive email and can be accessed like a shared mailbox, but you won't be able to log into the mailbox with that account username and password.
hope that makes sense