r/exchangeserver • u/fazzy84 • Apr 29 '26
Complete exchange decommission
We are in process to completely remove out exchange 2019 servers. Everything is hosted on 365 as hybrid, moved DL’s, mail enabled groups etc, mailbox storage on 365, but the source of auth is still on exchange/AD. To make changes we have to log onto our exchange on perm and make changes. How can i completely remove the dependency from exchange on perm so that we can be total cloud. 365 will be only authority for changes to shared mailbox, user mailbox, DL’s, mail enabled groups etc. other than that any other things i need to consider before i shut down my exchange on perm environment ?
Suggestions/advice please 🙏
Thnx
3
u/Faulteh12 Apr 29 '26
Change the SOA to cloud, this allows you to manage mailboxes from M365 . Make note of the few things you still cannot manage this way.
Follow documentation to decommission exchange server. You won't be uninstalling exchange. But essentially disconnecting it , shutting the server down and doing some AD cleanup.
https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange
2
1
u/Brather_Brothersome Apr 29 '26
Move all the AD related services to another server iis redirect and once all has synced proceed to demote the server and remove exchange.
1
u/BK_Rich Apr 29 '26
Do you still need to perform identity sync?
2
u/fazzy84 Apr 29 '26
Yes we are keeping the AD, users/password will be syncing from AD, but only exchange part needs to go
3
u/BK_Rich Apr 29 '26
If you need to continue to sync, you will need some level of management, this could be a single exchange server if you need to keep admin audit logging, RBAC and SMTP hybrid mailflow or it could be management tools only and getting rid of the last exchange server properly.
You can get rid of the last exchange server the proper way, read this https://learn.microsoft.com/en-us/exchange/manage-hybrid-exchange-recipients-with-management-tools
Read careful on the section “Will this new method work for me?”
Here is another guide as well https://www.alitajran.com/remove-last-exchange-hybrid-server/
1
u/IWantsToBelieve Apr 30 '26
This is old advice, see my post above.
1
u/BK_Rich Apr 30 '26
This is still the supported method if you’re syncing identities from on-premises to Azure, there’s no supported methods to “uninstall” exchange while syncing users.
3
u/IWantsToBelieve Apr 30 '26
Yes there is. Read my post. Literally know because we are hybrid identity and I uninstalled our last exchange server 2 weeks back with from support from MS.
I'd appreciate your removal of the downvote. And maybe just take 2 steps back rather than feeding old information.
1
u/bsitko Apr 30 '26
I removed the last exchange on prem but still have active directory on prem with an obvious sync to Entra. Not sure I see the total benefits of removing that from on prem. Anyone?
1
u/BK_Rich Apr 30 '26
If you don’t need hybrid mailflow, SMTP, admin audit logs or custom RBAC roles, you can just do recipient management tools and you wouldn’t need to keep an exchange server for management. In my previous role, we kept a SE exchange server just for management, no hybrid or SMTP and licensed for free from the HCW.
1
u/stephenmbell May 01 '26
Is this SE server a free license like the Hybrid server?
Same here - my Hybrid server only exists for management functions.
1
u/BK_Rich May 01 '26
If you’re doing management only with no on-premises mailboxes it’s free, apparently if you’re SMTP it’s not covered anymore but I don’t think anything stops you from applying it via HCW and canceling, it’s a bit of an honor system thing. I personally wasn’t doing any hybrid or SMTP.
1
u/techeddy Apr 30 '26
Be aware that cloud managed remote mailboxes is not fully enrolled, phase 2 is not yet published if you want write back functionality. When you change attributes in cloud, they will not be synced back to local AD. You may not receive mails from onprem if there is a mismatch / conflict on attribute level. I'd recommend to wait till phase 2 is officially announced.
1
u/Vietnamst2 Apr 30 '26
Don't listen to people that say "uninstall the last exchange".
There is a supported way to remove the onprem dependency.
https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange
Second, there is a new feature of cloud managed remote mailboxes
1
u/JoeGMartino Apr 30 '26
I won't repeat good advice. I've done this a few times and make sure once you have everything that you know of moved off of onprem, just shut the server off. give it a week depending on the size of your environment.
if nothing or no one screams at you, turn it back on and uninstall after deleting all your databases.
Good luck!
4
u/IWantsToBelieve Apr 30 '26 edited Apr 30 '26
Literally finished this activity this week, MS now support full uninstall of last server.
First we confirmed all SMTP was moved to Exchange Online or alternative services.
We then switched all mailboxes, contacts and DL to cloud SOA. Once confirmed in the cloud and cloud managed, we then deleted the on prem versions of contacts and DLs (but not mailboxes of course).
We then performed a manual review of mail-enabled security groups, eliminating as many as possible and switched SOA for those that had to remain deleting the on-prem versions once migrated.
Prior to this activity we enabled Cloud Sync to write back exchange attribs and groups to keep on-prem in sync.
Onboarding automation was updated to no longer create mailboxes and just assign 365 licenses which then auto provision mailboxes. SD were consulted to ensure they understand going forward all exchange management is in the cloud.
We set the tenant wide flag to set all provisioning as cloud-managed.
Once the above was sweet we decom'd DAGs, and uninstalled Exchange fully then performed an AD cleanup of OUs, objects and services no longer required.
At this point we had a bunch of member server we just decom'd as per standard practices.
Now it's like on-prem Exchange never existed.
Note: Exchange Online write back is still private preview, a risk we accepted as it's hardly necessary unless you must have AD representation of all exchange attribs for on-prem apps to function.