1

Have a company looking to migrate from G Suite to 365. The admin there asked me about it as I’m well versed on the admin side for 365. I’m a full blown 365/Azure AD connect/ADFS/Exchange Hybrid setup however which is vastly different from what they want to do. I’ve implemented full cloud only 365 scenarios where it’s not tied to an on prem AD at all as well. This scenario falls in between those implementations.

When last I checked, and this still seems to be the case, if you want to sync your on prem AD to Azure AD for your 365 accounts, you still need an Exchange hybrid server to be officially supported. Has anyone heard differently in this regard? I really don’t want to introduce an Exchange hybrid server back into this particular environment.

Ultimate goal is simple account provisioning/password sync without the dreaded, you can’t modify this because it’s synced from an on premise account issues with Exchange online.

One option here is to be cloud only and they will need to manually create accounts the way they do things now with G Suite. That wouldn’t be the end of the world, but I’m curious as to if they can improve on that a bit.

There’s also the option of Windows Server Essentials Experience role managing the 365 side. I may have to set up a trial and test that out. If anyone is currently using it and wants to provide feedback on how it works for you, that would be appreciated.

9 Spice ups
2

I’m not entirely clear on your question but, We have on premise AD/DC and ADconnect but no On Premise Exchange server. This is certainly supported.

1 Spice up
(jonahzona) 3

I don’t think you need an Exchange Hybrid in order to sync AD. At my last job, I was working on rolling out an Hybrid solution, and I did the sync well before working on the Exchange side of things.

As Azure AD Connect has replaced DirSync, check the requirements here: (nothing about needing Exchange) Microsoft Entra Connect: Prerequisites and hardware - Microsoft Entra ID | Microsoft Learn

What you WOULD need an Exchange Hybrid server for was if you wanted to manage those accounts locally through the exchange interface. In the scenario you are describing, you would just use the 365 management tools.

Hope that helps. If it doesn’t, this message will self destruct in 5 seconds…well, not really…

1 Spice up
4

I have done the same. It works fine, but Microsoft recommends having on-premises Exchange for hybrid environments to ease management.

5

You can set up AD Sync without local Exchange.

You can also set up Office 365 without Synching passwords.

6

I’ve seen people link to a document that says Microsoft will not support any 3rd party tools including AADConnect (it’s 3rd party?) but I think the document was dated and I’ve never had issues with Microsoft supporting it.

7

How do you manage things like adding additional e-mail addresses? I would expect the 365 side to come back and tell you that you can’t modify the user because they are managed by your on prem directory.

8

I know you can, but I think you will run into difficulty when you go to manage e-mail addresses, aliases, etc on the exchange online side.

9

proxyaddresses attribute in AD.

10

I have seen several things that state it’s completely unsupported. I’m not going to advise someone to deploy an unsupported scenario.

11

" When directory synchronization is enabled for a tenant and a user is synchronized from on-premises, most of the attributes cannot be managed from Exchange Online and must be managed from on-premises. This is not due to the hybrid configuration, but it occurs because of directory synchronization. In addition, even if you have directory synchronization in place without running the Hybrid Configuration Wizard, you still cannot manage most of the recipient tasks from the cloud. "

That’s the one I am concerned about.

For me, that’s not an issue, I run a hybrid exchange, but in their case they won’t have one. ADSI edit and Powershell isn’t going to be a good solution for that particular group. It wouldn’t be an issue at all for me, but this isn’t a group with any powershell experience. (I’ve already told them they need to learn if they are going 365.) That’s what got me reading up on the Windows Server Essentials experience role.

12

Worked fine for me, multiple clients, over many years and Support has helped when I had issues with AADConnect. (Shrug)

13

Password sync is one of the things they would actually like to have. Don’t get me wrong, if push comes to shove, it can be cloud only and completely separate management as they do now with G-Suite. I’m just seeing if it’s possible for them to leverage some of the existing AD infrastructure without going a full hybrid route or having to jump through manual attribute editing hoops.

Ideal world, would be accounts are sync’d from AD but the exchange management is completely cloud based. Microsoft just isn’t there yet I don’t think, but ultimately I think that’s where they are going to need to go if they want to kill off on prem exchange completely.

14

I don’t use Powershell for things like this. No need to run ADSIEdit separately either. Just add the Attributes tab to ADUC. Part of my procedure when I create a user is to do it normally then click on the Attributes tab, go to proxyaddresses and add the SMTP account. Just one more step vs having to support an onsite Exchange server.

On my clients that have never had onsite Exchange I run the Exchange Setup with the switch to just extend the schema to have it add any Exchange specific attributes I commonly use like to hide a user from the address book. (or you can use Powershell for that)

15

Then it comes down to is it supported. I would have no problem making that work, but if I recommend it to someone else and they have an issue, I don’t want a situation where they open a ticket with Microsoft and are told that’s not a valid configuration. Now it’s back on me as being to one that said to do it that way.

If MS would let you sync AD and manage the exchange portion completely online, I’d ditch my hybrid server.

16

Officially supported or not, I’ve never had a problem and it’s just one of many AD attributes that sync with AADConnect. I understand your point though.

17

Everything I have read says it is not supported although it should be. I myself am running a hybrid environment currently that I am slowly working on trying to get away from and be cloud only. (boatload of Distribution Groups to re-create on the 365 side). The password sync is the main feature I still want to keep but am willing to forego if it means getting rid of in-house Exchange server. Trying to cloud the whole damn company save for their network and desktop/laptop and maybe a DC, honestly.

18

Anyone looked into this for small businesses? It’s kind of a funny situation looking at this from an enterprise environment where you have adconnect/adfs/hybrid and looking into how someone best does this when they don’t have the last 2 pieces. It’s easy for me to say sure just throw in a hybrid server because that’s how I manage it. That doesn’t really work for them.

19

I modify SIP and SMTP under AD attribute Proxyaddress if needed and hide from GAL using the MSExchaangeHideFromGAL attribute - these attributes are residual from having Exchange added to AD (adds those attributes) but have not had an Exchange server for years with no problem.

I believe it’s having the attributes in AD that you need, not the Exchange server itself, if you’re running in Hybrid mode

20

We migrated from on premise Exchange 2010 to Office 365 several years ago. We have Azure AD connect to synchronize on our premise AD with Office 365 and it’s been working great.

We don’t have an on premise Exchange server. As others have mentioned in this thread, the proxyaddress attribute in ADUC is important to check when creating a new user or renaming an existing user. When I create a new account, I also make sure to fill in the “email address” field in ADUC so that when Azure AD connect synchronizes the account, it gets the proper email address and not the @blah.onmicrosoft.com address.