License requirement for EOP Quarantine for On-Prem users in Hybrid

[Tom Gould]

If MX is switched to Office 365 in a Hybrid environment and we want to use EOP and Quarantine for On prem mailboxes, what licenses are required? We are in the process of moving all of the mailboxes to Office 365. 

We have E3 Licenses but i do not want to assign the EXO licenses before they are migrated. 

[#2 · Accepted solution]

You can use EOP standalone licenses, no need to assign E3 if they just need hygiene solution.

[#3]

In 1 Month all of the users will be in Office 365 with E3 licenses. We would like to just switch them to E3 now and get EOP features while they are waiting to be migrated. 

I know back with DirSync you should never assign a license until after the batch completes. But i have read in some random places (i am not sure i trust the source) that with Azure AD Connect you can assign licenses anytime now.

[#4]

Well you can just assign them the E3 license with the ExO service disabled then. You are paying for the full price of E3 regardless of which services are enabled for the user, so I don't believe you will be in any license violation. Best check with your TAM or local MS folks though, none of us here are authorized to quote licensing terms on behalf of Microsoft.

You can also try calling EOP support directly to get clarification from them, the numbers are here: https://technet.microsoft.com/en-us/library/jj723132(v=exchg.150).aspx

[#5]

That makes sense. So I have 2 questions now.

What license feature will enable quarantine feature.

If we enable the exo license before a user is migrated, will it break mail routing or the migration process?

[#6]

The EOP licence gives you the quarantine. If all you have is the E3 licence the you have the quarantine option, as the E3 includes EOP.

If you are doing a hybrid migration and have synced the ExchangeGUID attribute from on-premises Exchange Server then Exchange Online will not provision a mailbox when you licence the user for Exchange Online. If the migration does not involve a sync from AD, or you filter attributes out of the sync, or doing a cutover migration then don’t provide a EXO licence until you need to as this will create a second mailbox and the world will end! Check in the cloud with Get-Recipient | FT Name,ExchangeGUID and see if each object has a GUID before you move the mailbox. If so, you are safe to licence.

[#7]

Does the E3 License need to be applied for users to get a quarantine message? 

[#8]

No - just the EOP licence. As said above, if you apply the E3 licence you get everything else as well but if you are specifically after the EOP functionality then you only need the EOP licence for every on-premises mailbox that a user logs into