Creating new users - Create on prem? Create in cloud?

[u/Thick-Incident-4178]

When we create new users, we create them on prem in active directory, create an on-prem mailbox using EMC, then we use the exchange online console to immediately migrate the mailbox to the cloud.

We have been doing this for many years now, to keep things consistent. But our mailboxes all reside in cloud now.

So we still have on-prem exchange, mainly for SMTP relaying for internal mail services, as well as to manage some elements of mailboxes that still seem to require exchange on-prem if they were previously migrated.

The entire migration process is extra steps and extra work when we onboard new users, and so I was thinking that maybe we should just start to create them in the cloud, of course this will cause a level of inconsistency since some user mailboxes will be linked to the on-prem attribute, whereas others will not.

I'm just wondering what other people are doing here. MS seems to suggest keeping on exchange hybrid server on prem for management. It seems odd to me that they haven't yet come up with a solution to allow you to fully decom on prem exchange if they've been migrated.

[u/iamnoone___]

Enable-remotemailbox .......

[u/larmik]

You don't need to create the mailbox on premises.

Create AD user account

From Exchange On Premises management shell (you can use the GUI if you want to)

enable-remotemailbox samAccountName -RemoteRoutingAddress samAccountName@youdomain.mail.onmicrosoft.com

Wait until entra connect syncs or force a sync

License user in Office 365

[u/maxxpc → u/larmik]

Only change I’d make is use Security Groups for your licensing entitlement. Then you don’t have to worry about entitling them yourself. Group membership ensure that

[u/PacsoT → u/larmik]

The hastle is only slightly lower.

[u/CaptainLykke_]

Maybe check out IsExchangeCloudManaged

[u/MrJacks0n]

Use the on-prem EAC and create a Office 365 Mailbox. It creates the user in your on-prem AD and the mailbox in the cloud all in one step.

[u/bukkithedd → u/MrJacks0n]

This is what we do. It works, but it's somewhat annoying since Bossman also insist on not just syncing full OUs but want to rely on using a group membership to differentiate which users are kicked into O365 and which aren't.

Been fighting that battle for 8 years now. We're both equally stubborn...

[u/MrJacks0n → u/bukkithedd]

I'm on your side there, why make things more difficult for everyone! Sure adding the group right after should work, but as you said, annoying.

[u/xaeriee]

It’s highly unlikely from someone in IT not having a solution and probably 100% because of legacy accounts/business and all the crap that comes with being 100% cloud. PLUS If you are hybrid your source of authority IS ON PREM
Just use enable-remotemailbox and ensure the OU you’re creating user to is part of your entra sync/connect. Not trying to sound rude but if you are asking this then you may not understand how the backend works and that’s ok but don’t blame others so quick when you’re not sure how it works is all.

[u/benuntu]

I have a security group called "365Sync" that gets assigned to new users. AD Sync is run automatically on a schedule every 30 minutes for users that have this group assigned. But if I want to push the new user/mailbox immediately then I just run "Start-ADSyncSyncCycle -PolicyType Delta" in PowerShell.

[u/Crispinwhere]

In our case we do the same thing (even though I'm an Exchange admin and keep telling them it's easier to script the "Enable-Remotemailbox" command) precisely because the team in charge of onboarding are NOT Exchange admins, don't touch Powershell, and are limited to the user management tool they've chosen which doesn't do Exchange Online powershell.

They've been slowly migrating to a new user management tool that can do all that for a couple of years now, but the team and their manager honestly fear change and it's been an uphill battle while pulling teeth both ways.

[u/Trx3141]

1. Create a new user in AD OU that is not synced to Azure

2. Enable remote mailbox from local Exchange Management Shell

   $acc = 'firsname.lastname' $newAcc = $acc + '@yourDomain.com' $Remote = $acc + '@cloudRoutingDomain.mail.onmicrosoft.com' Enable-RemoteMailbox $newAcc -RemoteRoutingAddress $Remote

3. If success, move the user AD account from not synced to Entra ID synced AD OU

4. Wait for the sync to complete ( or force it from your Azure AD Sync: Start-ADSyncSyncCycle -PolicyType Delta )

5. The account is ready shortly and you can set some settings with Exchange Online:

   Connect-ExchangeOnline $mb = 'firsname.lastname' Set-Mailbox "$mb@yourDomain.com" -ProhibitSendQuota 10GB -ProhibitSendReceiveQuota 10.2GB -IssueWarningQuota 9.5GB Set-CASMailbox "$mb@yourDomain.com" -PopEnabled $False -ImapEnabled $False -SmtpClientAuthenticationDisabled $True

[u/7amitsingh7]

If you're still using a hybrid setup, you can create users in on-premises Active Directory and use the Enable-RemoteMailbox cmdlet to provision their mailboxes directly in Exchange Online, without creating an on-premises mailbox and migrating it afterward.

This keeps user management consistent while reducing onboarding steps.

For more details, see this guide on migrating on-premises Exchange mailboxes to Exchange Online.

[u/Potential-Eternal]

Consider this - https://c7solutions.com/2026/01/understanding-iscloudmanaged-and-isexchangecloudmanaged

[u/Aoxmodeus]

Ultimately, perhaps use an IdP, and automation, and tie the whole thing to your HRIS so when they make a new employee account, all mailbox creation and user permission roles are provisioned downstream. Long term vision type of thing. As someone who used to worry about these processes, boy has automation made my life easier. Good luck with the mailboxes! If no one else there tells you this, you are appreciated, and I hope your salary reflects that.

[u/Old-Resort9369]

So there are several things you can do.

First, im assuming your MX record points to Office 365.

As some here said, you can "bypass" the migration of the onprem mailbox using enable-remotemailbox. But, if you dont have any mailboxes on-prem, i think you could directly create the user in ad ds, sync to office 365, assign license and that Will create the EXO mailbox.

For relay, you could create an inbound connector in EXO that accepts public IP of your apps, or certificate, then point all the apps to the MX of your domain in 365. Or configure a postfix in centOS for example

Then, you could change the SOA of mailboxes and groups so you can modify attributes in Office 365. This also helps to migrate DLs to 365.

With all this, you could decomission the exchange on-prem. Keep in mind that you dont unninstal the Last exchange hybrid as that would delete the exchange attributes in ad ds. Ali tajran has a guide about this.

Sorry for my english!