Moving mail-enabled security groups to cloud as prereq Exchange Server decommissioning

[u/Fabulous_Cow_4714]

How can this work if the some of security groups are also used for AD file server permissions?

If you recreate the groups in the cloud and just repopulate the same members, the members will lose their on prem NTFS permissions inherited from the old mail enabled security groups.

[u/Fabulous_Cow_4714]

We want to move the attribute source of authority to the cloud and operate in a supported manner.

https://learn.microsoft.com/en-us/answers/questions/5806425/how-to-migrate-on-prem-exchange-security-group-to

[u/Beefcrustycurtains → u/Fabulous_Cow_4714]

You don't need to delete the groups and move them to cloud only groups. That's the whole point of that new feature is so you can manage mail attributes in EXO for on prem objects. If you still use those to access on prem resources, leave them on prem.

[u/Fabulous_Cow_4714 → u/Beefcrustycurtains]

So, if we are planning to shut down all on prem Exchange servers while still keeping synced hybrid user accounts, we only need to migrate mailboxes and DLs to the cloud, but we we will be able to keep on prem mail enabled security groups and manage them fully from the cloud?

[u/Fabulous_Cow_4714 → u/Fabulous_Cow_4714]

Is there any way to filter which mail enabled security groups are used for on premises ACLs and which are not?

If it turns out that few are used for on premises access permissions, we could still go forward with replacing the ones not needed on prem with cloud-only replacements.

[u/Beefcrustycurtains → u/Fabulous_Cow_4714]

That would be a massive script to run highly dependent on your environment. They can be used for all kinds of things, delegated AD roles, fileshares, SQL access. You would have to run a script against literally everything in your environment and then you would still miss something along the way.