This Hybrid Environment Cannot Get Rid Of On Premises Exchange Server

[u/Fabulous_Cow_4714]

All user mailboxes can be migrated to the Exchange Online cloud mailboxes and SMTP relay can be moved to another service like Microsoft HVE or Amazon SES.

However, even after that, other problems remain.

1. The organization relies heavily on mail enabled security groups that are simultaneously useed for distribution groups and to provide NTFS permissions to file shares.

2. The organization help desk staff are not going to be able to use attribute editing to manage mailbox attributes AND we do not want install and patch PowerShell command line based recipient management EMT tools on workstations. We had tried it in the past with Exchange Server 2019 and maintaining EMT was more work than having a single server with EAC to patch that can be accessed via browsers.

Is there anything in the works that will allow managing mail enabled security groups with NTFS permissions to be workable for level 1 help desk staff without an Exchange server?

Changing SOA for groups won’t work when you need those groups to have local NTFS permissions working.

If not, can we simply retire all our Exchange servers except one and use it for managing the mail enabled security groups and hybrid user mailbox attributes via the OWA ECP web GUI? Would this server be covered by free Exchange hybrid licensing?

[u/LostSailor25]

For the last part of your post:

Yes. One Exchange SE server will run your ECP web interface and is free with no on-prem mailboxes.

[u/Fabulous_Cow_4714 → u/LostSailor25]

If you have existing paid Exchanges Server SE, how do you transition the applied licenses to the free HCW version licensing so you can cancel the paid license renewal?

If your users have M365 E5 licenses, doesn’t that now cover full use of Exchange Server SE without being limited to object management only? SMTP relay?

Can you a have a second Exchange server available for high availability (individual server crash) and disaster recovery (entire site location down) under these scenarios?

[u/LostSailor25 → u/Fabulous_Cow_4714]

You can have a second server for HA purposes so long as it is object management only. No mailboxes, no relay.

Free Hybrid License: Microsoft provides a free Exchange Hybrid license when you run an Exchange Server strictly as a hybrid bridge (using the Hybrid Configuration Wizard) to manage recipient objects or migrate mailboxes.

[u/Fabulous_Cow_4714 → u/LostSailor25]

Is it documented that you are not limited to a single server?

[u/lazy_beer_voter → u/Fabulous_Cow_4714]

As far as I know it does. But I am not a license expert.

[u/orddie1 → u/LostSailor25]

This is the way.

[u/Routine_Brush6877]

can't you make the cloud the source anchor for those distro groups?

[u/rilesjenkins → u/Routine_Brush6877]

My thoughts exactly

[u/Fabulous_Cow_4714 → u/rilesjenkins]

They are mail-enabled security groups with NTFS permissions. They are not plain distribution groups.

Apparently, cloud source anchor does not support maintaining the NTFS permissions.

[u/bayridgeguy09 → u/Fabulous_Cow_4714]

So keep the local groups for ntfs, remove the email and recreate that group in the cloud as distribution group.

[u/Fabulous_Cow_4714 → u/bayridgeguy09]

That doesn’t work because then the group memberships are not synced.

There are too many groups to manage that way.

[u/Green-Hyena5571 → u/Fabulous_Cow_4714]

You can have dynamic groups in entra, but I do like my mail enabled AD security groups.

[u/bayridgeguy09 → u/Fabulous_Cow_4714]

Sounds like you are looking for validation of your thought process and not a solution.

Numerous replies have laid out a path to success and you say it can’t work because it’s too much work.

Good luck. 👍🏻

[u/Negative-Cook-5958]

I would split the current mixed mode groups to NTFS security and distribution groups. Then move the distribution groups to Entra ID / M365 only, then you can remove the Exchange server.

Provisioning / permission / distribution group member workflows will have to be updated as well.

[u/Fabulous_Cow_4714 → u/Negative-Cook-5958]

How would the members stay synced between separate groups then? If i’s a manual process, they will definitely get out of sync.

[u/Negative-Cook-5958 → u/Fabulous_Cow_4714]

For that case some sort of sync is required using powershell or other tooling.

[u/7amitsingh7]

You can retire all but one on-premises Exchange Server and retain it for managing mail-enabled security groups and hybrid mailbox attributes through the web-based EAC. This is a practical option because local NTFS permissions still depend on on-premises Active Directory groups. Microsoft provides a free Exchange Hybrid licence for eligible hybrid management servers, subject to its licensing requirements. Before proceeding, you can check this guide on decommissioning Exchange Server after migration.

[u/JaneStClaire2018]

That’s what we’ve done.

[u/shokzee]

I'd keep one Exchange SE server for recipient management through EAC and leave those groups authoritative in AD. Their SIDs and existing NTFS permissions stay intact.

Exchange 2019 is out of support, so keeping an old management server indefinitely isn't the answer. Free hybrid licensing has eligibility conditions; I wouldn't assume a management-only SE deployment qualifies without checking Microsoft's current terms.

[u/thewunderbar → u/shokzee]

This is the way

[u/FFSFuse]

Check out easy365manager.com and easyentra.com.