Hybrid Exchange

Mailbox Moves without a Batch

I recently came across an issue when moving mailboxes to Exchange Online where the migration user had failed with the following error:

Error: MigrationTransientException: MAPI provider is not supported for mailbox with version ‘[version info]’ on server.

It turns out this is an issue with a recent update to Exchange Online and Microsoft is rolling out the fix. I was able to create the move request without creating a batch by running the following from Exchange Online PowerShell:

There is also a similar process if you needed to move a mailbox from Exchange Online back to On-Prem:

Hybrid Exchange

Unable to remove Public Folder Mailbox after migration

I was recently trying to remove the last Exchange 2013 Exchange server having already migrated to Exchange Online and setup the Exchange 2016 recipient management server. I was getting an error that the last database couldn’t be removed because it still had mailboxes on it. Indeed there was one Public Folder mailbox even though the Public Folder had successfully migrated to Exchange Online.

When trying to remove the Public Folder mailbox it gives the error “No active public folder mailboxes were found. This happens when no public folder mailboxes are provisioned or they are provisioned in ‘HoldForMigration’ mode. If you’re not currently performing a migration, create a public folder mailbox.”

I was able to resolve this by running this command:

With the mailbox removed, I could remove the mailbox database and uninstall the Exchange 2013 server.

Exchange Online

Data Consistency Score

Microsoft recently announced improvements in mailbox move requests with something call Data Consistency Score. It is meant to prevent you from setting the bad items to a high number like 5000.

Improving Migrations Using Data Consistency Scoring – Microsoft Tech Community – 1105920

I started not to set any bad item limits and let the new feature go to work. After a few batches it all worked and I was impressed. Last night I hit a snag where the move request was stuck and wouldn’t complete. The move request statistics was stuck on Synced.

I was required to check the migration user to find the data consistency was set to Investigate:

I was required to set the migration user in Exchange Online to approve skipped items:

After setting this the mailbox completed the move request successfully.

Hybrid Exchange

Manage Distro Groups from Cloud mailbox

One of the downsides to Hybrid Exchange is moving a mailbox to Exchange Online and no longer being able to manage Distribution Groups. One solution I have found allows the cloud mailboxes to login to On-Prem ECP and manage the distribution groups they own from a web browser.

From the Exchange Management Shell On-Prem you will need to create a new RBAC Role and modify the permissions to allow only update distribution group member and add distribution group member.

Now you can add a user to the role group:

The user can then login to the Exchange Admin Center search for the group they own and modify the members:

If they try and modify a group they are not an owner for it will not allow them to save the changes:

Hybrid Exchange

Hybrid mail flow with Exchange 2003

I was working with a customer who had Exchange 2010 and Exchange 2003 wanting to move to Exchange Online. We successfully setup the Hybrid Configuration Wizard with Exchange 2010 and were able to move mailboxes to Exchange Online. There was now an issue with mailboxes on Exchange 2003 unable to send messages to mailboxes that had migrated to Exchange Online. They would receive an NDR:

Your message did not reach some or all of the intended recipients. A configuration error in the e-mail system caused the message to bounce between two servers or to be forwarded between two recipients. Contact your administrator. #5.4.6

We found the following error in the Exchange 2003 application logs:

Event Source: MSExchangeTransport

Event Category: NDR

Event ID: 3020


A non-delivery report with a status code of 5.4.6 was generated for recipient {recipient} Message-ID {Message-ID}.

Cause: A forward loop was detected by the categorizer. This is a common hosting configuration problem caused when someone uses the provisioning tool to create a contact in one organization unit and creates a user in a different organization user that share the same e-mail address.

The resolution was to change the Accepted Domain for tenant.mail.onmicrosoft.com from Authoritative to Internal Relay:

Hybrid Exchange

Remote mailbox moves without Hybrid

I have been working with a customer who recently acquired a new company that has 400+ mailboxes running on two Exchange 2010 servers. They need all mailboxes moved to Office 365 where the tenant is already setup has an existing Hybrid configuration to an on-prem Exchange 2016 environment. They don’t want the new users setup with Azure ADConnect and will be created In Cloud. If possible they want to perform MRS mailbox moves instead of paying for licenses for 3rd party migration tools.

I did some testing in a lab environment and have been successful in setting up MRS mailbox moves without having ADConnect or running the Hybrid Configuration Wizard. I decided to share the steps involved if anyone is in a similar position and needs some help.

  • Installed Exchange 2010 SP3 as the customer on-prem server was SP1
  • Enabled MRSProxy on the Web Services Virtual Directory
  • Created new Receive Connector on the 2010 server scoped for the O365 IP addresses and configured with for Fqdn with a valid SSL certificate
  • Add the new domain to the Office 365 portal and verify
  • Changed the accepted domain in Exchange Online from Authoritative to Internal Relay
  • Add outbound connector for the domain in Exchange Online
  • Add inbound connector for the domain in Exchange Online
  • Create a migration endpoint pointing to the on-prem Exchange server
  • Setup federation from On-Prem Exchange to Exchange Online (this was easier to do the the EMC)
  • Setup Organization Relationship from On-Prem to Exchange Online
  • Setup Organization sharing from Exchange Online to On-Prem (Exchange Admin Center)
  • Now you need to create new Mail Users in the Office 365 tenant and these can be scripted out and run from a PowerShell session
  • Add the LegacyExchangeDN from the On-Prem 2010 to the Mail User ExchangeGUID in Exchange Online
  • On-Prem Exchange will need to add the accepted domain for <tenant>.mail.onmicrosoft.com as authoritative
  • On-Prem mailboxes need the alias address for <tenant.mail.onmicrosoft.com>. This can be done using an Email Address Policy 
  • Mail User recipients in Exchange Online need to have both the following addresses added <tenant>.mail.onmicrosoft.com> and <tenant>.onmicrosoft.com
  • Assign the MsolUser with a valid license for Exchange Online

Note that because the MailUser has a value for ExchangeGUID the provisioning service within Exchange Online doesn’t convert this into an empty mailbox when you assign a license. Now you can perform a remote mailbox move and when the move completes the objects will convert from a MailUser to a UserMailbox in Exchange Online and from a UserMailbox to a MailUser in Exchange On-Prem.

I recommend testing this out before doing any live production mailboxes and ensure mail flow is working. You will also want to validate free/busy and ensure all mailboxes including resource and shared get provisioned as MailUser in Exchange Online before moving any mailboxes. You will also need to create Distribution Groups in Exchange Online and add the LegacyExchangeDN to prevent users getting bounce back messages when sending to them.


Dynamic Distribution Groups

I was recently working with a customer who had setup the hybrid configuration and moved some pilot users mailboxes to Exchange Online. After moving the mailboxes he stop receiving emails sent to a dynamic distribution group.

I confirmed the list of recipients in the dynamic distribution group by running the following:

The list of recipients were all UserMailbox because the dynamic distribution group was created filtering on city and RecipientType UserMailbox.

After moving mailboxes to Exchange Online the on-prem mailbox is converted to a MailUser and no longer included in the dynamic distribution group. In order to fix this you need to update the recipient filter to include MailUser objects.

In this situation we were filtering based on city and I was able to fix the problem for each site with the following:

Don’t worry about adding back any of the additional filters like:

(-not(Name -like ‘SystemMailbox{*’)) -and (-not(Name -like ‘CAS_{*’))

(-not(RecipientTypeDetailsValue -eq ‘DiscoveryMailbox’))

(-not(RecipientTypeDetailsValue -eq ‘PublicFolderMailbox’))

(-not(RecipientTypeDetailsValue -eq ‘ArbitrationMailbox’))

(-not(RecipientTypeDetailsValue -eq ‘AuditLogMailbox’))

These get automatically added back into the filter for you.

Hybrid Exchange

Completing individual move request

Exchange Online was updated recently and I have now changed the way I complete a single move request inside a batch without completing the entire batch. Previously I would run Set-MoveRequest -SuspendWhenReadyToComplete $false and Resume-MoveRequest

Now with the new batch creations the scheduling options mean that method no longer works and the move request remains synced. Here is a screen shot of the new options available when scheduling a batch:

Exchange Online will synchronize the content from Exchange on-premises to the cloud and keep them synchronized with subsequent incremental syncs. Now if I want to complete one move request from the batch without completing the entire batch you can perform the following:

If you know a date and time (September 14th 11pm) you want the one mailbox to complete you can set the date and time: