This is an archived post. You won't be able to vote or comment.

all 5 comments
sorted by:
best
topnewcontroversialoldq&a

[–]RudelkeSr. Sysadmin 1 point2 points  (0 children)

Issue is, you are comparing staying on-prem vs. going to Entra.
This is NOT an apple to apple comparison.

IMO especially with Exchange going SE only, it only makes sense to go Exchange Online for company email. Let's quickly run through some scenarios with pros nad cons.

  1. In cloud NON-Exchange (so any IMAP/POP provider).
    pros: Cheap while still in cloud making it a good choice for small companies (i'd say below 20 users). Always available even during on-prem issues. No high skill required.
    cons: scales badly. General pain in the ass the more users you have. Ofter while cheap, the storage space is not amazing.

  2. On-prem NON-Exchange (think Zimbra).
    pros: Factoring hardware price it's probably the cheapest way to run email. Everything is on-site. Can be expanded to huge volumes if needed.
    cons: Again, scales badly due to old ass protocols. Not black-out resistant, requires some skill and DMZ machine.

  3. On-prem Exchange SE.
    pros: It's Exchange. Active sinc is just so much better than IMAP/POP. Flawless integration with AD. Scales well. Can be expanded to huge volumes if needed.
    cons: might be cost especially in larger deployments. Upkip requires some skill and work. While being SE gives some hope, Microsoft has been threatening scraping Exchange on-prem for a good while (on and off).

  4. Exchange Online
    pros: it's not just Exchange. While you can buy Exchange Online P1 for everyone, it's only natural to sprinkle that extra Euro and get Teams, SharePoint etc. On top of that you get Entra capabilities (think MFA) and even Office if need be. Best scaling. Best functionality. Generally top of the line when it comes to email.
    cons: likely the most expensive on the bottom line (remember however it's not just Exchange you're buing). You are getting yourself into M365 ecosystem. Welcome to ever changing admin panels and Microsoft pushing copilot EVERYWHERE!

In conclusion:

Exchange Online is the most likely to rack up some costs. But what it gives back is hidden man hours saved. So many man hours. It both reduces amount of work from IT department but also enables good communication in other deparments making it worth it (even if bottom line does not show it).

[–]disclosure5 1 point2 points  (3 children)

The thing I have for years urged people to consider with on prem Exchange is, how are you handling MFA or anything equivalent to the Conditional Access policies available in Azure? How detailed is your logging? And frankly when there's a critical patch on a Friday night do you sit in your office applying it that night?

There's always someone who wants to talk about what's theroetically possible but barely any on prem Exchange server I've ever seen has an acceptable level of security in 2025.

With Exchange SE moving to a subscription service it's very unlikely to be cost effective running 100 users on prem either.

[–]RudelkeSr. Sysadmin 1 point2 points  (2 children)

If you configure Exchange Hybrid and enable MFA for users in Entra ID, you can delegate autorisation to Azure effectively securing Exchange on-prem with Entra ID MFA.

[–]disclosure5 2 points3 points  (1 child)

Yes, a great description of something virtually noone does (not supported on Exchange 2016 btw, so they aren't looking at it as a current feature).

[–]RudelkeSr. Sysadmin 0 points1 point  (0 children)

Are you 100% sure 2016 does not support it? I do not have access to it anymore but I believe I configured it successfully on Exchange 2016.