Exchange Server to Exchange Online: every scenario, from first batch to last server

Moving the mailboxes is the easy half of leaving Exchange Server; the hard half is deciding what happens to the servers, and to the Active Directory attributes they manage, once the mailboxes are gone. This decision-first guide takes you from choosing a method through the hybrid migration and the mail flow cutover to four supported end states: keep hybrid, keep one Exchange Server SE, remove the last server, or manage recipients in the cloud, each with its requirements, trade-offs and rollback points.

Decision 1: how the mailboxes move#

Three questions decide the method: the source version, the number of mailboxes, and whether accounts stay managed in on-premises Active Directory. Hybrid is the only native method that moves mailboxes in both directions, but it adds complexity, so Microsoft's decommissioning guidance asks organizations with fewer than 2,000 mailboxes to consider a cutover first.

Cutover moves everyone in one batch into new cloud accounts, so plan for new Outlook profiles, X500 addresses for replies to old messages (see my IMCEAEX and X500 guide) and empty mail-enabled security groups created in the cloud beforehand, because the service can't tell security groups from distribution groups.

With directory synchronization, use the Hybrid Configuration Wizard (HCW). Minimal hybrid configures what mailbox moves need and skips coexistence features such as cross-premises free/busy, so it suits projects measured in weeks; full hybrid adds them and suits long projects or any mailbox that stays on-premises. Either works with the classic topology, where Exchange Online calls your published EWS endpoint, or the modern topology, where the Hybrid Agent connects outbound only and has documented limits, such as no Hybrid Modern Authentication (see my Hybrid Agent article). Hybrid moves keep the mailbox GUID, so Outlook profiles keep working.

Decision 2: where you want to end up#

Pick the end state now, because it changes what you build: Cloud Sync for writeback, new relay paths, or SE kept current.

A and B keep an Exchange Server SE in service. C keeps AD as the source of authority for Exchange attributes and edits it with the Exchange Management Tools; D moves that authority to Exchange Online or ends synchronization. Microsoft's newest decommissioning page calls the Management Tools route a temporary workaround, so if you're starting today, D1 is usually the cleaner destination.

Readiness checklist#

1. Get the on-premises side onto Exchange Server SE. In September 2026 the Exchange team announced that Exchange Online throttles, then blocks, mail that Exchange 2016 or 2019 servers send over the OnPremises inbound connector unless they're at the final public update level from October 2025, and that the next increase will leave only Extended Security Update customers or SE able to qualify. Upgrade (in place from 2019 or side by side from 2016), then run the Health Checker.
2. Budget the server licenses. Microsoft's HCW FAQ now says the free hybrid license isn't available for Exchange 2019 or later hybrid servers, and Microsoft describes the last Exchange server as one that must stay patched, licensed and reachable. Confirm SE licensing for every server you keep.
3. Synchronize identities (hybrid only). Use Entra Connect Sync or Cloud Sync with the Exchange hybrid option enabled, clear sync errors (duplicates and soft-match failures) and settle sign-in (PHS, PTA or federation). A cutover needs synchronization off instead.
4. Prepare namespaces and certificates. Verify every SMTP domain in Microsoft 365. Classic hybrid needs Autodiscover and EWS published over HTTPS with a public certificate and MRSProxy enabled; modern hybrid needs the Hybrid Agent, ideally on more than one server. SMTP between the organizations also uses a public certificate (see hybrid mail flow and TLS).
5. Prepare the hybrid app and the Graph path. Since 31 October 2025, hybrid free/busy, MailTips and photos work only through the dedicated Exchange hybrid app on supported builds. The May 2026 Hotfix Update for SE (KB5081755) lets free/busy, photos and, partly, MailTips use Microsoft Graph instead of EWS, which matters now that EWS is being switched off in Exchange Online (see my EWS switch-off guide). The servers need outbound HTTPS to the Entra and Graph endpoints.
6. Inventory what depends on Exchange: mailbox types and sizes, delegates and shared mailboxes (cross-premises permissions), public folders, relay connectors, applications using on-premises EWS, journaling and archiving, any gateway in front of Exchange, and Outlook versions.

# Exchange Management Shell: inventory
Set-AdServerSettings -ViewEntireForest $true
Get-Mailbox -ResultSize Unlimited | Group-Object RecipientTypeDetails | Select-Object Name, Count
Get-Mailbox -PublicFolder
Get-OrganizationConfig | Format-List PublicFoldersEnabled
Get-ReceiveConnector | Where-Object { $_.PermissionGroups -match 'AnonymousUsers' } |
    Format-Table Name, Bindings, RemoteIPRanges -AutoSize

# Classic hybrid: enable MRSProxy on each Mailbox server
Set-WebServicesVirtualDirectory -Identity "EX01\EWS (Default Web Site)" -MRSProxyEnabled $true

# Outbound reachability for the hybrid app and the Graph-based features
Test-NetConnection -ComputerName login.microsoftonline.com -Port 443
Test-NetConnection -ComputerName graph.microsoft.com -Port 443

What good looks like: you can name every relay sender by IP range, every public folder mailbox and the count of each mailbox type, and both network tests return TcpTestSucceeded : True.

The hybrid migration, step by step#

1. Run the HCW from an Exchange Server SE server#

Download the wizard from aka.ms/HybridWizard, run it on the SE server that will carry hybrid traffic, and choose Full or Minimal, then Classic or Modern. For full hybrid, pick the TLS certificate on the mail flow pages and leave Centralized Mail Transport off unless compliance requires outbound internet mail to leave through on-premises; it must be off again before you remove the last server. The wizard doesn't change your MX record. If it fails, the log in %UserProfile%\AppData\Roaming\Microsoft\Exchange Hybrid Configuration explains why (see HCW errors). Then confirm the dedicated hybrid app, including its Graph permissions, as described in Microsoft's Deploy dedicated Exchange hybrid app article.

2. Prove the plumbing before you move anyone#

# Exchange Online PowerShell
Get-MigrationEndpoint | Format-List Identity, RemoteServer
Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer mail.contoso.com -Credentials (Get-Credential)

# Exchange Management Shell (on-premises)
Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox onprem.user@contoso.com | Format-List

What good looks like: both tests return Success, and with full hybrid an on-premises user and a test cloud user can see each other's free/busy. Fix failures now with my migration endpoint and free/busy guides.

3. Run a pilot batch#

Put a handful of IT mailboxes, including a shared mailbox, in a CSV with one column, EmailAddress. Start the batch but complete it yourself, so the final switch happens when you choose.

# Exchange Online PowerShell
New-MigrationBatch -Name "Pilot" -SourceEndpoint "Hybrid Migration Endpoint - EWS (Default Web Site)" `
    -TargetDeliveryDomain "contoso.mail.onmicrosoft.com" `
    -CSVData ([System.IO.File]::ReadAllBytes("C:\Migration\Pilot.csv")) -AutoStart
Get-MigrationBatch -Identity "Pilot" | Format-List Status, TotalCount, SyncedCount, FailedCount
Get-MigrationUser -BatchId "Pilot" | Get-MigrationUserStatistics
Complete-MigrationBatch -Identity "Pilot"

# Exchange Management Shell, after completion
Get-RemoteMailbox pilot.user | Format-List PrimarySmtpAddress, RemoteRoutingAddress

What good looks like: the batch moves from Syncing to Synced to Completed, the on-premises object becomes a remote mailbox whose remote routing address ends in mail.onmicrosoft.com, Outlook restarts once and connects to Exchange Online, and with full hybrid free/busy works both ways. License users as they move. For stalled or failed users, see my migration batch guide and the MRS error reference.

4. Migrate in waves#

• Group users who share mailboxes, calendars or delegate access, and move them together.
• Let batches sync during the week and complete them outside business hours; completion is a short final sync, not a full copy.
• Keep a list of mailboxes that must stay on-premises, with the reason, because it decides between end state A and the others.

5. Keep provisioning correct during coexistence#

Create new cloud mailboxes from on-premises with New-RemoteMailbox, or Enable-RemoteMailbox for existing AD users, so AD holds the Exchange attributes (see remote mailboxes). Don't simply license a synced user to create a cloud mailbox: on-premises Exchange won't know it exists, and mail from on-premises senders won't route to it.

Mail flow cutover: MX, Autodiscover, SPF and DANE#

During coexistence, MX can stay on-premises, stay on a gateway, or, with full hybrid, move to Exchange Online early; Exchange Online then delivers mail for on-premises mailboxes through the hybrid connectors. With a third-party gateway in front, read my Enhanced Filtering and gateway-to-EOP guides first.

1. Lower the MX TTL to 3,600 seconds or less, at least one old TTL before the change. Microsoft notes other organizations can take up to 72 hours to notice a new MX, so keep the old path able to deliver meanwhile.
2. Use the MX value Microsoft gives you: in the Microsoft 365 admin center, go to Settings › Domains, select the domain, open DNS records and run Check health. It's either <token>.mail.protection.outlook.com or, for domains with DNSSEC enabled, a host under mx.microsoft such as contoso-com.o-v1.mx.microsoft. Copy it rather than building it from the old pattern.
3. Add DNSSEC and inbound SMTP DANE later, as a separate change. Microsoft's procedure expects one MX at priority 0 or 10 with no fallback MX, and MTA-STS in testing mode during the switch.
4. Point Autodiscover at Exchange Online (CNAME autodiscover to autodiscover.outlook.com) in internal and external DNS, but only after the last mailbox and public folder have moved; then clear the service connection point so domain-joined Outlook stops asking on-premises (see Autodiscover and SCP).
5. Update SPF with include:spf.protection.outlook.com, removing on-premises IP addresses only when nothing sends from them, and turn on DKIM and DMARC (see my SPF, DKIM and DMARC guide).

Resolve-DnsName -Name contoso.com -Type MX
Resolve-DnsName -Name autodiscover.contoso.com -Type CNAME
Resolve-DnsName -Name contoso.com -Type TXT | Where-Object { $_.Strings -match 'v=spf1' }

# Exchange Management Shell: clear the SCP once Autodiscover points to Exchange Online
Get-ClientAccessService | Set-ClientAccessService -AutoDiscoverServiceInternalUri $Null

# Exchange Online PowerShell: DNSSEC and DANE, after the migration is stable
Enable-DnssecForVerifiedDomain -DomainName contoso.com
# Add the returned DnssecMxValue as an MX at priority 20 and test it, make it priority 0
# (legacy MX 30), delete the legacy MX, then:
Enable-SmtpDaneInbound -DomainName contoso.com

What good looks like: message trace shows internet mail arriving at Exchange Online and leaving without an on-premises hop (see message trace), the admin center's health check shows the MX as OK, and new Outlook profiles set up without certificate prompts.

Public folders#

If Get-Mailbox -PublicFolder returns anything on-premises, migrate them with batch migration (see my public folder migration guide) or retire them. On-premises public folders block Exchange uninstall, and Microsoft recommends against removing Exchange and hybrid while they're still in use, because pointing Autodiscover to Exchange Online breaks hybrid public folder access. Until they move, you're in end state A.

Apps and devices that relay through Exchange#

Printers, scanners, monitoring tools and line-of-business apps often send through an anonymous receive connector. The inventory command lists those connectors and their RemoteIPRanges; protocol logs show who actually connects (see protocol logging). Uninstalling Exchange removes every receive connector, so each sender needs a new path first.

Exchange Online's RejectDirectSend setting is off by default. Once it's on, anonymous mail that uses one of your accepted domains as the sender and doesn't match a connector bounces with 550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization from unauthorized sources, so create partner connectors for approved devices first. For SMTP AUTH and connector errors, see my relay and 5.7.57 guide.

# Exchange Online PowerShell
Get-OrganizationConfig | Format-List RejectDirectSend
Set-OrganizationConfig -RejectDirectSend $true

The end states: requirements, trade-offs and exact steps#

B, C and D assume every mailbox is in Exchange Online, MX points to Exchange Online, and relay and public folders have a decision. Run on-premises commands in the Exchange Management Shell after Set-AdServerSettings -ViewEntireForest $true.

A. Keep hybrid for the long term#

Choose it when some mailboxes must stay on-premises, applications or public folders still depend on Exchange Server, or you want to keep moving mailboxes both ways. Microsoft recommends staying hybrid while you need on-premises SMTP relay or public folders, with enough servers for the remaining hybrid functions. It requires:

• Exchange Server SE on every server in the hybrid path, on current cumulative and security updates; Exchange Online enforces a minimum build for servers that send over the OnPremises connector.
• A license for each server, since the free hybrid license doesn't cover Exchange 2019 or later.
• The dedicated Exchange hybrid app, and the SE May 2026 HU or later so free/busy, photos and some MailTips run over Microsoft Graph.
• Certificate renewals and an HCW rerun after namespace or certificate changes (see renewing the hybrid certificate), plus directory synchronization with the Exchange hybrid option.

You give up nothing functionally; you keep internet-facing servers to patch, certificates to renew and licenses to pay for. Rollback: none needed; from here you can still move to B, C or D.

B. Keep one Exchange Server SE for recipient management#

Choose it when every mailbox is in Exchange Online, you keep directory synchronization, and you want the on-premises Exchange admin center, Exchange RBAC and audit logging for recipient changes. This is Scenario 2 in Microsoft's decommissioning guidance: keep one server (OK) or two (better), with no DAG or other high availability. It requires a patched, licensed SE server and, as Microsoft recommends, the Exchange hybrid option left enabled in Entra Connect or Cloud Sync. You give up the hybrid features and the ability to move mailboxes back without rerunning the HCW.

1. Confirm public folders are migrated: if PublicFoldersEnabled is Remote and you still need them, migrate them first.
2. Point MX and Autodiscover to Exchange Online in internal and external DNS, then clear the SCP.
3. Run Remove-HybridConfiguration so the hybrid objects aren't re-created later.
4. Uninstall every other Exchange server (see uninstalling an old Exchange server).
5. Disable the OAuth intra-organization connectors on both sides. Microsoft's page uses the names below; newer HCW runs name them HybridIOC - <GUID>.
6. In the Exchange admin center, under Mail flow › Connectors, disable or delete the inbound and outbound connectors the HCW created. If the server you keep relays application mail through Exchange Online, leave its connector until that traffic has another path.
7. Under Organization › Sharing, remove the O365 to On-Premises - <identifier> organization relationship.

# Exchange Management Shell
Get-ClientAccessService | Set-ClientAccessService -AutoDiscoverServiceInternalUri $Null
Remove-HybridConfiguration
Get-IntraOrganizationConnector -Identity ExchangeHybridOnPremisesToOnline | Set-IntraOrganizationConnector -Enabled $False

# Exchange Online PowerShell
Get-IntraOrganizationConnector -Identity ExchangeHybridOnlineToOnPremises | Set-IntraOrganizationConnector -Enabled $False

Rollback: rerun the HCW to rebuild hybrid if you ever need to onboard or offboard mailboxes again.

C. Remove the last server and manage recipients with the Management Tools#

Choose it when all of Microsoft's conditions are true: every mailbox and public folder is in Exchange Online; you manage recipients in AD and sync with Entra Connect or Cloud Sync; you don't need the on-premises EAC or Exchange RBAC; PowerShell alone is fine; you don't need auditing or logging of recipient changes; and you're down to one Exchange server used only for recipient management.

You give up RBAC (after shutdown only Domain Admins and members of the Recipient Management EMT group can manage recipients), the EAC, recipient audit logging, and most cmdlets. The Recipient Management snap-in covers the New, Set, Get, Remove, Enable and Disable cmdlets for mail users, mail contacts, remote mailboxes and distribution groups (not Upgrade-DistributionGroup), group membership, email address policies, and Get-User/Set-User. Output types differ from remote PowerShell, so test your scripts.

1. Prove nothing is left: Get-Mailbox returns nothing, built-in admin mailboxes are disabled with Disable-Mailbox, and the mail.onmicrosoft.com remote domain is the target delivery domain.
2. Install the Management Tools from current Exchange Server SE setup on a domain-joined machine (Microsoft's page asks for Exchange 2019 CU12 setup or later), plus the Windows Remote Server Administration Tools. If you use the Scripting Agent, copy ScriptingAgentConfig.xml across.
3. As a Domain Admin in Windows PowerShell, load the snap-in and run Add-PermissionForEMT.ps1, then add your recipient admins to the Recipient Management EMT group.
4. Test, shut the server down and test again. New- and Set- commands pause for about 40 seconds until the AD clean-up, because the admin audit log initializer looks for the powered-off server.
5. Power it back on and clean up hybrid: Scenario 2's steps above, the federation trust and certificate, the OAuth key credentials and, for modern hybrid, the Hybrid Agent application and agent. Confirm MX and Autodiscover, then shut it down for good.
6. Optional and irreversible: run CleanupActiveDirectoryEMT.ps1, then erase and reformat the old server.

# Domain-joined admin machine, Exchange Server SE setup media
Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /Role:ManagementTools

# Windows PowerShell as a Domain Admin (not the Exchange Management Shell)
Add-PSSnapin *RecipientManagement
& "$env:ExchangeInstallPath\Scripts\Add-PermissionForEMT.ps1"
Set-RemoteMailbox test.user -EmailAddresses @{Add="smtp:test.alias@contoso.com"}

# Exchange Management Shell on the last server (step 5)
Remove-FederationTrust "Microsoft Federation Gateway"
Get-ExchangeCertificate | Where-Object { $_.Subject -eq 'CN=Federation' } | Remove-ExchangeCertificate
& "$env:ExchangeInstallPath\Scripts\ConfigureExchangeHybridApplication.ps1" -ResetFirstPartyServicePrincipalKeyCredentials

To patch the tools later, note that a cumulative update on a tools-only machine can stop with Active Directory must be prepared with 'Setup /PrepareAD' before Exchange Server management tools can be updated to a newer CU. Run Setup.exe /PrepareAD, then Setup.exe /m:Upgrade (both with the license switch), and rerun CleanupActiveDirectoryEMT.ps1 if you used it. Security updates install normally. My last-server article covers this route in more detail.

Rollback: until you run the clean-up script, you can power the old server back on. The AD clean-up can't be undone.

D1. Move Exchange attribute management to Exchange Online, then uninstall#

Choose it when you want to manage mailboxes in Exchange Online PowerShell, the Exchange admin center or the Microsoft 365 admin center while AD stays the identity source. Setting IsExchangeCloudManaged on a mailbox moves the source of authority (SOA) for its Exchange attributes to the cloud; names, UPN, department and other identity attributes stay in AD. The change is per mailbox, so you can pilot it. It requires:

• Entra Connect Sync 2.5.190.0 or later, or Cloud Sync; older Connect Sync builds keep trying to push on-premises values for cloud-managed mailboxes and fail.
• For optional writeback to AD, the Cloud Sync provisioning agent 1.1.1107.0 or later. If you use Connect Sync, Cloud Sync runs alongside it and handles only the writeback; Microsoft supports writeback for up to 600,000 cloud-managed mailboxes per tenant.
• An Exchange Administrator (recommended), Hybrid Identity Administrator or Global Administrator signed in interactively; certificate-based app-only sessions can't change this property.
• Patience: after a completed move or an on-premises change, wait for the sync cycle plus 24 hours before you switch that mailbox.

You give up on-premises control of Exchange attributes. Only some write back, such as the custom and extension attributes, proxyAddresses, mail and the recipient type values; settings like hiding from address lists or Send on Behalf live only in the cloud. Mail-enabled groups and mail contacts have no such flag and need Group or Contact SOA transfer in Microsoft Entra ID, and deleting a user still starts with deleting it in AD.

1. Pilot one mailbox and check that cloud edits stick.
2. Optionally enable writeback in the Microsoft Entra admin center: Entra Connect › Cloud Sync › New configuration › EXO to AD attribute sync (Preview), then Create and Start provisioning. Change CustomAttribute1 in the cloud and, after about 20 minutes or a provision on demand, read it on-premises with Get-RemoteMailbox. Configurations created before 3 August 2026 lack the Mail-to-mail mapping; Microsoft's fix, Restore default mappings, also resets custom mappings.
3. Switch every directory-synchronized mailbox.
4. Only when nobody will create recipients on-premises again, make cloud management the tenant default. New users are then created in AD, synced, and given a mailbox by assigning an Exchange Online license. Enabling it earlier is unsupported: recipients created on-premises afterwards won't be provisioned in Exchange Online.
5. Transfer SOA for the mail-enabled groups and contacts you still need to manage.
6. Uninstall the last server with Microsoft's procedure: re-verify the prerequisites (including Centralized Mail Transport turned off, or outbound mail breaks), clean up hybrid while Exchange runs, check that no user, archive, public folder, arbitration or audit log mailboxes remain, run setup, then tidy Exchange Online.

# Exchange Online PowerShell (interactive sign-in)
Set-Mailbox -Identity pilot.user@contoso.com -IsExchangeCloudManaged $true
Get-Mailbox -Identity pilot.user@contoso.com | Format-List Identity, IsExchangeCloudManaged
Set-Mailbox -Identity pilot.user@contoso.com -CustomAttribute1 "ManagedInCloud"

Get-Mailbox -ResultSize Unlimited |
    Where-Object { $_.IsDirSynced -eq $true -and $_.IsExchangeCloudManaged -eq $false } |
    ForEach-Object { Set-Mailbox -Identity $_.PrimarySmtpAddress -IsExchangeCloudManaged $true }

Set-OrganizationConfig -ExchangeAttributesCloudManagedByDefault
Get-OrganizationConfig | Format-List BlockExchangeProvisioningFromOnPremEnabled

# Hybrid clean-up while Exchange still runs
# Exchange Management Shell
Remove-HybridConfiguration
# Both Exchange Management Shell and Exchange Online PowerShell
Get-IntraOrganizationConnector | Where-Object { $_.Name -like 'HybridIOC -*' } | Remove-IntraOrganizationConnector -Confirm:$false
# Exchange Online PowerShell
Get-InboundConnector | Where-Object { $_.ConnectorSource -eq 'HybridWizard' } | Remove-InboundConnector
Get-OutboundConnector | Where-Object { $_.ConnectorSource -eq 'HybridWizard' } | Remove-OutboundConnector
Get-OrganizationRelationship | Where-Object { $_.Name -like 'O365 to On-Premises*' } | Remove-OrganizationRelationship

# Last server, after the federation and OAuth clean-up shown in route C (step 5)
Get-Mailbox; Get-Mailbox -Archive; Get-Mailbox -PublicFolder; Get-Mailbox -Arbitration; Get-Mailbox -AuditLog
Setup.exe /m:Uninstall /IAcceptExchangeServerLicenseTerms

# Exchange Online PowerShell afterwards
Get-OnPremisesOrganization; Get-MigrationEndpoint
Set-AcceptedDomain -Identity contoso.com -DomainType Authoritative   # if it's still InternalRelay

Remove the orphaned on-premises organization object and migration endpoint with Remove-OnPremisesOrganization and Remove-MigrationEndpoint. Setup leaves the msExch* schema extensions and each user's Exchange attribute values in AD, and the Autodiscover container's Exchange Online SCP keeps pointing domain-joined Outlook at the cloud.

Rollback: set IsExchangeCloudManaged to $false and the next sync overwrites that mailbox's cloud values with AD's, so export anything changed in the cloud first; do the same before offboarding a mailbox to on-premises. Set-OrganizationConfig -ExchangeAttributesServerManagedByDefault undoes the tenant default. The uninstall is the point of no return.

D2. Stop directory synchronization completely#

Choose it when Microsoft 365 no longer needs on-premises AD as an identity source. This is Microsoft's Scenario 1: every mailbox is in Exchange Online, users will be managed in Microsoft 365, and you need neither directory nor password synchronization. If you sign in through AD FS, sort that out first, because Microsoft's guidance treats keeping AD FS as a reason to keep directory synchronization. You give up AD-based identity for Microsoft 365 for everyone at once, as synced users and groups become cloud-only. For a gradual path, object-level SOA transfer for users, groups and contacts, now generally available, switches individual objects to cloud-managed without turning synchronization off.

1. Do the Exchange clean-up from Scenario 1: check public folders, point MX and Autodiscover to Exchange Online in internal and external DNS, clear the SCP, delete the HCW connectors, remove the organization relationship and disable the OAuth intra-organization connectors.
2. If the change is permanent, uninstall the sync client (Connect Sync or Cloud Sync) first; otherwise the portal can still show optional features such as password hash sync as enabled.
3. Turn off synchronization with Microsoft Graph PowerShell, signed in as a Hybrid Identity Administrator, and confirm OnPremisesSyncEnabled no longer reports True.
4. Uninstall Exchange from the remaining servers.

Connect-MgGraph -Scopes "Organization.ReadWrite.All,Directory.ReadWrite.All"
Get-MgOrganization | Select-Object OnPremisesSyncEnabled
$organizationId = (Get-MgOrganization).Id
$params = @{ onPremisesSyncEnabled = $false }
Update-MgOrganization -OrganizationId $organizationId -BodyParameter $params
Get-MgOrganization | Select-Object OnPremisesSyncEnabled

Rollback: you must wait 72 hours before turning synchronization back on, and the change clears on-premises properties such as OnPremisesDistinguishedName and OnPremisesSamAccountName from cloud objects, so re-enabling means matching objects again (see soft-match failures).

Rollback points: if it goes wrong#

Change one layer at a time (mailboxes, MX, Autodiscover, servers), and back up Active Directory before any irreversible step.

Verify the finished state#

• MX matches the admin center value, the health check shows OK, and autodiscover resolves to autodiscover.outlook.com internally and externally.
• Message trace shows internet mail in and out without an on-premises hop, and every former relay sender delivers a test message.
• A new Outlook profile on a domain-joined PC connects to Exchange Online with no certificate prompt (see Autodiscover troubleshooting).
• For C or D, Get-InboundConnector | Where-Object { $_.ConnectorSource -eq 'HybridWizard' } returns nothing in Exchange Online.
• For C, a member of Recipient Management EMT changes a remote mailbox and Exchange Online shows the change after the next sync.
• For D1, no directory-synchronized mailbox still has IsExchangeCloudManaged set to False; for D2, OnPremisesSyncEnabled isn't True.

References#

• How and when to decommission your on-premises Exchange servers in a hybrid deployment (Microsoft Learn)
• Manage recipients in Exchange Hybrid environments using Management tools (Microsoft Learn)
• Cloud-based management of Exchange attributes for Remote Mailboxes in hybrid environments (Microsoft Learn)
• Decommission the last Exchange Server after transferring SOA to cloud (Microsoft Learn)
• Migrate email to Exchange Online using the Exchange cutover method (Microsoft Learn)
• Microsoft Graph support for hybrid features in Exchange Server SE (May 2026 HU) (Microsoft Support)
• How SMTP DNS-based Authentication of Named Entities (DANE) works (Microsoft Learn)
• Turn off directory synchronization for Microsoft 365 (Microsoft Learn)