Removing the last Exchange server in hybrid: what's supported and how to manage recipients

Once every mailbox lives in Exchange Online, the Exchange server left behind in many hybrid organisations has one job: editing Exchange attributes in Active Directory so directory synchronisation can carry them to the cloud. Microsoft now supports ways to stop running that server. In this post I'll compare them and walk through the management-tools route, including the mistakes that are hard to undo.

How it works: why the last server existed#

With directory synchronisation, Active Directory is the source of authority for synced users, including Exchange attributes such as proxyAddresses and targetAddress. By default Exchange Online won't edit those attributes on synced objects, and they should be changed with Exchange cmdlets, not by hand. Hence the server. The two ways out:

The rest of this post covers the management-tools route.

Is the management-tools route right for you?#

Microsoft's conditions, all of which must be true:

• All mailboxes and public folders are in Exchange Online; no Exchange recipients remain on-premises.
• You manage recipients in AD and sync with Microsoft Entra Connect Sync or Cloud Sync.
• You don't need the on-premises Exchange admin center or Exchange RBAC, and PowerShell alone is fine.
• You don't need auditing or logging of recipient management.
• You're down to one Exchange server, used only for recipient management: no SMTP relay for printers or applications. If it relays, move that first (see SMTP AUTH and relay options).

What you give up:

• RBAC. Once the last server is off, only Domain Admins and members of a new Recipient Management EMT group can manage recipients.
• Cmdlet breadth. The snap-in covers the New/Set/Get/Remove/Enable/Disable cmdlets for MailUser, MailContact, RemoteMailbox and DistributionGroup (but not Upgrade-DistributionGroup), group membership, email address policies, and Get-User/Set-User, nothing more.
• Script compatibility. Output types differ from remote PowerShell; for example, EmailAddresses comes back as a ProxyAddressCollection rather than an ArrayList.

Step-by-step: from last server to management tools#

1. Prove nothing is left on-premises#

Set-AdServerSettings -ViewEntireForest $true
Get-Mailbox -ResultSize Unlimited
Get-Mailbox -PublicFolder
Get-RemoteDomain | Where-Object TargetDeliveryDomain | Format-List Name, DomainName

Good looks like: no mailboxes, no public folder mailboxes, and your coexistence domain (contoso.mail.onmicrosoft.com) as the target delivery domain. Built-in admin mailboxes aren't synced; Microsoft says to disable them with Disable-Mailbox. Fix the domain with New-RemoteDomain and Set-RemoteDomain -TargetDeliveryDomain $true.

2. Install the management tools#

Microsoft's article describes the tools from Exchange 2019 CU12 or later. Exchange 2016 and 2019 reached end of support on 14 October 2025, so use current Exchange Server Subscription Edition (SE) setup on a domain-joined server or workstation, and install the RSAT Active Directory tools too:

Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /Role:ManagementTools

If setup needs a schema update or /PrepareAD, plan it with whoever owns AD. Scripting Agent users: copy ScriptingAgentConfig.xml from $env:ExchangeInstallPath\Bin\CmdletExtensionAgents on the server to the same folder on the tools machine.

3. Delegate recipient management#

Sign in as a Domain Admin, open Windows PowerShell (not the Exchange Management Shell) and run:

Add-PSSnapin *RecipientManagement
& "$env:ExchangeInstallPath\Scripts\Add-PermissionForEMT.ps1"

The script creates the Recipient Management EMT security group. Add your recipient admins to it.

4. Test, shut the server down, test again#

As a member of that group, load the snap-in (every session) and make a harmless change:

Add-PSSnapin *RecipientManagement
Set-RemoteMailbox test.user -EmailAddresses @{Add="smtp:test.alias@contoso.com"}
Get-RemoteMailbox test.user | Format-List PrimarySmtpAddress, RemoteRoutingAddress, EmailAddresses

Then shut down the Exchange server and repeat. Expect New- and Set- commands to pause for about 40 seconds while the admin audit log initialiser tries to reach the powered-off server; the AD clean-up in step 6 removes the delay.

5. Clean up hybrid before the final shutdown#

Turn the server on again and complete Steps 1 to 8 for Scenario 2 in Microsoft's article on decommissioning on-premises Exchange servers in a hybrid deployment. Then remove the federation trust, the federation certificate and the OAuth key credentials on the Exchange Online first-party service principal:

Remove-FederationTrust "Microsoft Federation Gateway"
$fed = (Get-ExchangeCertificate | Where-Object { $_.Subject -eq "CN=Federation" }).Thumbprint
Remove-ExchangeCertificate -Thumbprint $fed
.\ConfigureExchangeHybridApplication.ps1 -ResetFirstPartyServicePrincipalKeyCredentials

If you run Modern Hybrid, remove the application with Remove-HybridApplication from the agent's HybridManagement.psm1 module and uninstall the Hybrid Agent. Confirm MX and Autodiscover DNS point to Exchange Online, then shut the server down.

6. Optional: clean up Active Directory#

If you'll never run Exchange Server again, run CleanupActiveDirectoryEMT.ps1 from $env:ExchangeInstallPath\Scripts with Domain Admin rights. It removes the system mailboxes, Exchange containers you no longer need, the Exchange security groups and their permissions on the domain and configuration partitions. It can't be undone. Afterwards, wipe and reformat the old server.

Verify#

• A non-domain-admin member of Recipient Management EMT can run Set-RemoteMailbox, and after the next sync cycle Get-Mailbox test.user | Format-List EmailAddresses in Exchange Online PowerShell shows the change.
• Mail flows both ways, and message trace shows no hop through the old server.
• New Outlook profiles set up without delays or certificate prompts; if not, look for leftover Autodiscover records (see Autodiscover troubleshooting).

Tips and gotchas#

• Patching the tools. A CU on a tools-only machine can fail, saying AD must be prepared with Setup /PrepareAD first. Run .\Setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms_DiagnosticDataON, then .\Setup.exe /m:Upgrade /IAcceptExchangeServerLicenseTerms_DiagnosticDataON, then re-run CleanupActiveDirectoryEMT.ps1 if you used it, because PrepareAD re-creates some objects. SUs install normally.
• Remote domains. If you later need New-RemoteDomain or Set-RemoteDomain, Microsoft allows loading Microsoft.Exchange.Management.PowerShell.SnapIn for that case only.
• Keep your own change log. Recipient changes are no longer audited, so record them in your ticketing system.

References#

• Manage recipients in Exchange Hybrid environments using Management tools (Microsoft Learn)
• Cloud-based management of Exchange attributes for Remote Mailboxes in hybrid environments (Microsoft Learn)