Exchange hybrid Communication Question

Question

My organization is in hybrid mode. We have already moved our users to the cloud. Now I have the security team asking me when I am going to turn off various services and exposrue to the outside. The problem I have is not knowing what I can turn off. Currently we only use Exchange for management purposes.&nbsp; If I turn off IIS or disable OWA will I kill that connection? I guess I just need to know How does Exchange on prem communicate to Exchange Online?
Clarification: How does Exchange On-prem communicate to Exchange Online in regards to management of user accounts? We aren't interested in using Exchange on-prem for any mail services at this point.
&nbsp;
At some point I am going to have to move off the current Exchange version. I am really considering to start over fresh with minimum configuration. Just bring up the boxes side by side and turn on the minimum I need to manage users with the new box. Instead of turning things off on the old box...I would just like to understand how Exchange is transporting management information to the cloud.

deleted · Answer

Ok. I understand that part. However what about the configurations, can IIS be turned off for OWA, ECP..etc and the various ports that are open to Internet and respond to external request? I guess the question that is being asked of me is can I reduce the footprint of Exchange to just management components and remove/turn off anything else? Examples...-if I go to the old OWA, IIS will respond. It displayed the IIS splash page but I have since redirected it to O365.-If you make EHLO request the server responds.-If I created an on-prem mailbox it will work because it is hybrid mode.Security folks are paranoid (by nature) so they want to turn everything off and run the bare minimum to do the management function.

dominik hoefling · Answer

You can decommission the hybrid connectivity as this is not needed for recipient management. But&nbsp;it is not recommended disable IIS or services like OWA, etc. You need a connectivity to Exchange Online for mailbox creation. And let's assume you would like to create a shared mailbox, you have to create it on-premises and migrate it to Exchange Online. This means, you need the migration endpoint, open ports, IIS, etc. (You can't create a shared mailbox in Exchange Online with hybrid in place).
&nbsp;
Block incoming ports to your Exchange like 25 and 587 for the EHLO response as your MX points to EOP. I guess you have to try it and verify the impact of disabling / blocking Exchange components. There is no official document from Microsoft.

loryan strant · Answer

Is your autodiscover pointed to Exchange Online, or still the on-prem server?

deleted · Answer

Autodiscover is point to Exchange online.

ian moran · Answer

Do you plan to keep Azure AD Connect running ?

Forum Discussion

Exchange hybrid Communication Question

8 Replies

Resources