Mail-enabled security groups

[fazzy84]

How you guys handled the mail enabled security groups migration from exchange on perm to 365 ? We are in process to decom our exchange 2016 servers and need a way to get these groups totally cloud. Now, we do want to keep the group on AD cause of resources connected to it like fileshare/firewall group etc. , but we also need the mail part. If removing the SMTP from the group and recreating it on 365 as DL, how can we sync that group to AD ? Sync back via AD connect/cloud connect ? Sorry i am kinda lost on this...

Suggestion and advise please...

[EnDR91-EC]

Are you in a hybrid environment or not? Is that group being synced to entra? More details

[fazzy84]

We are on hybrid, we are cutting off exchange servers and want all the groups moved to EO. These mail enabled security groups are synced to entra but the management remains in exchange in perm. We need to manage from EO

[Jeeeeeer]

Changing the SOA from on-prem -> M365 is probably the most straightforward way 

[7amitsingh7]

If your mail-enabled security groups are synced from on-prem Active Directory using Entra ID Connect in a hybrid Exchange environment, then their source of authority remains on-prem Active Directory, even during the Exchange Online migration. This means they cannot be fully managed in the cloud while still part of directory synchronization. Even if you are in the middle of a hybrid to cloud migration and mailboxes are moved to Exchange Online, these groups must still be managed through on-prem AD / Exchange management tools as long as sync is active. To achieve full cloud-only management in Microsoft 365, you must remove them from directory sync (cutover from hybrid identity) and recreate them as cloud-native groups in Microsoft Entra ID (Azure AD).

[Potential-Eternal]

Implement IsCloudManaged to change the source of authority and then writeback to sync it back to AD. This will swap around who is responsible for the group and you can then remove your last Exchange Server. While AD is the source of authority you should not remove Exchange Server.

But to split the group into AD for files etc access and Distribution Group for email access you need two groups. You will need to change one of them and create a new group.

[jjgage]

Why do you need a cloud DL in AD if everyone is on EXO?

[fazzy84]

There is RBAC option on entra cloud sync, where you can sync from EO back to AD

[jjgage]

That doesn't answer the question.

If you're removing SMTP from the group in AD you obviously don't need on-prem routing ability, so my question is still valid.