Microsoft 365 Minimal or Cutoff Migration?

[JasonL]

Hello,

I am currently running an on-premises Server 2016 domain with Active Directory and Exchange 2016 with around 65 users.  I am starting to plan for migrating our Exchange server to Microsoft 365 and would like to know what method, either Minimal or Cutoff, would be the best path to take.

Right now I currently have Azure AD Connect installed and syncing my users and passwords to the Microsoft 365 admin center.  If possible, I would like to keep Azure AD Connect after the migration so I can manage user accounts and passwords on my Domain Controller still but I am a little confused on how to accomplish this.  If I want to keep directory synchronization enabled would I have no choice but to use the 'Cutoff' method?  The 'Minimal' method notes that it disables directory synchronization after the first initial sync, but what if I want to keep this on so I still have the ability to manage users/passwords locally and have them still sync to the admin center?  I am not sure what the best practices are for this, or if directory synchronization is even necessary if you plan to fully decommission Exchange from the domain like I do.  It seems that if syncing was turned off then you have to manage user accounts on the Domain Controller, but also then have to manage mailboxes in Exchange Online.  Is this the normal way to do this?  Can directory sync remain on indefinitely after migrating and decommissioning Exchange entirely? 

If any further information is needed to help clarify my intentions please let me know and I will explain the best I can.  Any help is very appreciated! 

Thank you,

Jason

[#2 · Accepted solution]

You can re-enable sync after the migration, that's not a problem. Do note that if you plan to decommission Exchange, having AAD Connect in the mix puts you in an unsupported configuration. Every configuration involving dirsync/AAD Connect requires you to keep at least one Exchange box for management purposes.

[#3]

Thank you for the information, Vasil. Since you mention that if I did decommission Exchange it would be in an unsupported state, what would be the recommendation for managing local Active Directory users and their mailboxes? Say, for example, a new user needed to be created, is the recommendation, without having AAD Connect, for you to create the user on your local Domain Controller in Active Directory, then as a second step create their mailbox in the Exchange admin center? It just seems like it would be far easier to manage things like that with AAD Connect still syncing users/passwords. I'm curious what other people normally do in a situation like this.  Do most people really choose to keep Exchange running even though it's not needed when all mailboxes are migrated to MS365? 

[#4]

That's the only supported configuration. It's a pain yes, but using the Exchange management tools is the only supported way to manage Exchange related objects and attributes. If you don't care about the "supported" bit, it's perfectly possible to do it with AD tools/PowerShell.

[#5]

Thank you for the clarification. I think for now I will start with the 'Minimal' option and see how easy things are to manage with Exchange still being in the mix and decide later whether to fully decommission it or not.

[#6]

@JasonL 

MSFT recommendation in currently described scenario is to go with hybrid (minimal/express) migration as you won't have any problems related to synchronization and management. If your plan is to get rid of complete on prem-infrastructure, then cut over is the best choice because you got only 65 mailbox users. One of the requirements before starting cut over is to actually stop the directory synchronization (AAD Connect). Once migration is done, you can reconfigure the AADConnect. If you choose to go with Cut Over but still wants to keep the on Prem AD, then you need to manage some properties on daily basis via powershell or AD tools. Most common example is proxy address. As the source of authority is on prem AD, any change in proxy of M365 will be written over once synced.

[#7]

Jason if you are syncing AD users via ADConnect then you should just do traditional Exchange Hybrid migration and not screw around with trying to decom exchange.

[#8]

Thank you for the recommendation, Kevin. I have decided to do exactly that for the time being. Hopefully the backend administration settings are incorporated into Exchange Online at some point so this is no longer a concern for people who want to decommission Exchange entirely but still use on-prem AD. Seems like that's something that really should have been already included honestly.

[#9]

Thanks for the suggestion, Shane. It does seem like it's entirely possible to administer Exchange Online via powershell or other tools, but in order to stay in compliance with Microsoft I am just going to leave my on-prem Exchange server online for now, which will also make it easier to manage. Even though I would absolutely love to completely decommission Exchange I would rather stay in compliance for now. Hopefully these tools are eventually built directly into Exchange Online at some point so this is no longer a concern.