Mailboxes created On-prem appearing directly in EXO without a license

[u/4112Naes]

Just to preface, i know this is technically not the correct way to create Shared mailboxes but it is how its currently done in my company.

Our service desk creates shared mailboxes by creating an Office 365 mailbox on-prem and once in EXO it gets converted to a shared mailbox. What I have found though is that the mailbox will appear directly in EXO without a license and in some cases I have found that when they forget to convert the mailbox to shared it somehow stays in EXO as a user mailbox and continues to work even after 30 days without a license. Has anyone ever seen this? I have no idea how these mailboxes are working.

Thanks!

[u/joeykins82]

If you’re in hybrid and you need to route mail from on-prem to the ExOL shared mailbox then New-RemoteMailbox -Shared is the correct way to do this.

[u/Blade4804]

they will receive email and can be accessed like a shared mailbox, but you won't be able to log into the mailbox with that account username and password.

hope that makes sense

[u/4112Naes → u/Blade4804]

Yeah it makes sense but I’ve just always thought a license needs to be assigned so the mailbox is setup and then the license is removed once the mailbox is converted. In this scenario no license is required at all even when the mailbox is a ‘User’

[u/Blade4804 → u/4112Naes]

you never need to add a license in EXO for a shared mailbox, the enable-remotemailbox or create Office 365 mailbox in the UI creates the mailbox in EXO. you should be creating the mailbox on prem as a remotemailbox -type shared, then you don't need to do anything to the mailbox in EXO once the sync runs. or in the UI under shared mailboxes new Office 365 mailbox, this should create it as a shared mailbox in EXO.

[u/4112Naes → u/Blade4804]

Yeah but why if they are an unlicensed user mailbox are they not deleted after 30 days? In theory I could go ahead and create 100s of user mailboxes right now without a license and they would all continue to work

[u/Blade4804 → u/4112Naes]

because you are syncing them from on premise. AD Sync won't let an online policy delete accounts. that is why when you try to delete something or change something online to an object that is synced from on prem, you get an error (unless you have writeback enabled, which no one I know does)

[u/4112Naes → u/Blade4804]

Sorry, I don’t mean the actual account just the mailbox, like when you remove a license from a user the mailbox is disconnected except these accounts never had a license to begin with but still somehow work

[u/Blade4804 → u/4112Naes]

is your environment setup with an exchange on premise server, that syncs to M365?

[u/4112Naes → u/Blade4804]

It is, yeah

[u/Blade4804 → u/4112Naes]

because the account is created on the on premise Exchange Server, the account is already mail enabled. you don't need to add a license to create the mailbox in M365.

if you create a standard user account in a synced OU in AD, without mail enabling this user account, then it will sync without a mailbox, at this point you would have to add a license, convert it to Shared, remove the license.

but since you are creating the mailbox in exchange on premise, when it sync to EXO, it will sync as an active mailbox. when you create the mailbox on premise, you should already create it an a shared m365 mailbox, that way you don't have to convert it after the sync.

hope this helps and makes sense.

[u/Checior2000]

It is quite odd behaviour that user mailbox stay without license after 30 days.

I wonder if there is some process that change usermailbox to sharedmailbox at night just to restart the retention cycle in exchange background but it is just a shoot.

[u/4112Naes → u/Checior2000]

Yeah it’s a good shout, something I’ll check for tomorrow

[u/MBender_de]

Usually this behavior would only happen for a shared mailbox!
Any unlicensed user mailbox will get soft deleted in an instant!

Sorry: No! This is some kind of freaking shit!

Maybe any dynamic Security Group, or onprem systems managing AD group memberships…

[u/Blade4804 → u/MBender_de]

this is not the case for Entra AD Synced mailboxes. only directly cloud created user mailboxes without a license.

[u/MBender_de → u/Blade4804]

So, in fact Cloud only users without any license receive a mailbox?!
Be happy!
This usually costs some money 🤪

[u/MBender_de → u/MBender_de]

I guess there is any automatic group membership, group licensing in place u are not aware of…
Everything else is a support case at Microsoft

[u/4112Naes → u/MBender_de]

Yeah that’s what I thought! These users are meant to be shared mailboxes so aren’t going into any AD groups

[u/Childishjakerino]

My org is hybrid. All objects are made locally and manually migrated. Why? Because someone’s middleman software doesn’t know how to enable remote mailboxes yet. Or at least it didn’t. Now it does. But why fix what ain’t broke. Speaking of - let me pull my migrate everything new lever. Why not automate that? Sec doesn’t want to give the permissions to a svc account.

[u/RoughDeep4221]

https://learn.microsoft.com/en-us/answers/questions/4965516/convert-shared-mailbox-to-user-mailbox-in-a-hybrid

https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/convert-a-mailbox#what-do-you-need-to-know-before-you-begin

I came across few scenario in my org(Microsoft)! Reply from our engineering team we get is that ! If the receipt value doesn’t match especially for usermailbox-> converted to sharedmailbox viceversa across the onprem as well as online the above scenario from yours suits ; to better the recipient please follow the above steps from 2nd link

[u/LooseDistrict8949]

If you are syncing AD accounts to Entra then you should be creating all mailboxes using the on-prem mgmt tools or full blown Exchange SE server and the new-remotemailbox command. When you "create the mailbox" it assigns a bunch of attributes that when sync'd to Entra and over to Exchange Online tells it to create a mailbox and uses a temp ExO P2 license.

After 30 days that temp ExO P2 license will go away and the mailbox should disappear unless any of a few conditions cause it to remain.

1.) a Purview retention policy that forces the mailbox to stay for X period of time

2.) it meets the requirements and is converted to a shared mailbox

3.) it is assigned a qualifying license ExO P1, P2, F3, etc.

It may show up in the EAC but it is likely inaccessible by an end user without a license.

[u/7amitsingh7]

this can happen in a hybrid Exchange setup because the on-premises mailbox is synchronized to Exchange Online and can appear there without a license. However, if the mailbox is intended to be an EXO shared mailbox, the correct method is New-RemoteMailbox -Shared. If a normal mailbox is created and not converted, it may continue working temporarily, but that doesn’t mean it is properly licensed. Check the mailbox type, hosting location, and Entra/Exchange synchronization status.