A few years ago, we created a web site that would allow our hybrid customers to obtain what’s generally known as the “hybrid key”. This self-service site would validate your O365 tenant and after a f...
Updated Apr 21, 2022
Version 4.0
Blog Post
2 MIN READ
Hybrid Configuration Wizard and licensing of your on-premises server used for hybrid
Some comments from somebody in the field who has been praying for the last Exchange Server requirement to be removed, but has happily excepted that it's a waiting game:
- I would stop calling the Hybrid Exchange Server, an Exchange Server. It's effectively a small footprint Server used to edit synchronized email attributes. There should be no data on it. If you have customers who can't afford to run one extra small footprint VM, I'd seriously consider steering the dialogue away from cost and towards value.
- Running Exchange 2016 on WS2019 vs WS2016 - WS2016 has an extended support end date of 1st of Dec 2027, WS2019 has an extended support end date of 1st of September 2029. It seems hopeful that Microsoft will have provided a solution that allows us to remove the last Exchange Server and continue to synchronize directories with Azure AD Connect between now and 2027, see comments from Greg Taylor above. I don't think those extra two years are going to be a killer. If you look at the Hybrid Exchange box as purely an Email attribute management server, there should be no functional difference between WS2016 and 2019
- If you didn't know that you needed to keep the last Exchange Server if you intended to main synchronized identities, you really should have done a bit more research. This has been fairly clear from the start.
- There are other options for identity - e.g. Okta SSO/Cloud Connect. But you are only really catering for one concern here, SSO (yes I know Okta SSO has some MFA capabilities and other niceties). Azure AD Connect is a requirement for a lot more "Hybrid" functionality aside from Exchange, such as Hyrbid Azure AD Join
- You can run Exchange Online/Office 365 standalone, no sync. You can even remove the last Exchange Server and identity sync after a Hybrid migration. Some people are happy with no identity sync. Some are not. What do your customers value more, end user experience or saving a few very minor dollars? Value vs cost.
- Another approach may be to quote on-prem Hardware, Exchange 2019, and them demonstrate how expensive it is to even get that up and running and how many features you simply do not get vs Exchange Online/365. Where is the MFA for Exchange On-prem? Duo can be used.....but just for OWA/ECP. Do you have Tier 2 storage for Archives? Are you even licensed to run Archives? Discussion around past concerns with Exchange on-prem can help. Have you ever had to perform any of the painful fixes that have cropped up over the years with On-prem Exchange, especially single instance Exchange Servers with Exchange Online? Is that a better scenario for both you and your customers/users? Have you ever had that one customer with 5TB of email who insist that they will accept nothing but 100% uptime for their Exchange 2007/2010 Server supporting 20 sites and 400 users, yet they will never let you run updates and discussions around migration go nowhere? Do you ever worry at night how tough it would be if some minor corruption occurred in the database? Is running the small Hybrid Exchange Management VM, with a free Exchange license such a big deal in comparison?
- Customer investment in traditional applications that require a lot of overhead to run are a bigger headache than the Hybrid Exchange scenario. If your customers invested in all SaaS that supported integration to Azure AD, and were happy to put ALL their data in Cloud platforms, would you really even need any on-prem/private cloud servers? Surely you would just join Azure AD and the source of authority would be that environment, not from a synchronized Active Directory.
- DO NOT USE ADSIEdit/Attribute Editor in lieu of the Hybrid Exchange box! Trust me, educating junior staff and new starters how to convert to and from shared mailboxes is a nightmare you can do without. So too is the eventual customer queries about why it takes so long to hide old users from the GAL. That's just scratching the surface. It's not worth it just to remove a relatively small management VM.