This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 52%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Hi All,
I am planning to migrate user mailboxes from Exchange 2016 to Office 365 and these few questions that I just cannot figure out the answers for. If anyone could please provide their expertise, I would be grateful.
1) I am planning to use Azure AD Connect for Password Synchronization and Password Writeback but not sure if to install Azure AD Connect before or after the migration.
2) Not all the users in my company have mailboxes so will that have any effect if I want to sync all users? I want users to use the self password reset tool to reset their own passwords.
3) If I install Azure AD Connect after the migration can I allow users to use their current AD passwords after the initial migration for them to log in to Office 365 for the first time.
Thank you so much for your time and help!!
Hi @JonVeev
According to your description, this question seems to be related to Exchange, so we would move the irrelevant tags.
What kind of migration are you going to perform? AAD Connect is a requirement for most migration types, but if you are planning to do Cutover migration, it's actually required to not have it enabled, as the migration process uses a different method to provision user objects. So in that case you will run it after the migration is complete.
The password sync process does not care whether the user has a mailbox or not. Once you enable PHS, every user in the scope of the sync process will be able to use his AD credentials to access Office 365.
hi, Thanks for your reply. Yes, I am planning to do a cutover migration of approx 250 mailboxes. I currently do not have AAD Connect enabled or installed but would like to enable it for Self Password Reset.
Two things:
2) After the sync from AAD Connect, If I understand correctly, It will sync all, let's say, 300 users but if I have only 250 mailboxes I just have to not assign mailboxes to the rest 50 and it should be ok, correct? The rest 50 users with no mailboxes will still be able to leverage the Self Password Reset tool?
Also, I am planning to use AAD Connect - Password Writeback and Pass synchronization so that users can access on-prem resources with the same password.
Thank you so much!
Again, AAD Connect cares about user/group objects, not mailboxes. Every user object that is in scope of the sync will be able to use its on-premises credentials, regardless of whether he has a mailbox or not.
You can install AAD Connect after you perform the migration and before users are given the go to login to Office 365. Or you can distribute the temporary credentials generated for the migrated accounts. You cannot use the on-prem credentials before AAD Connect with PHS is in place.
Hey Michev,
Thank for the info. I really appreciate it. The last question, I have read on several other posts that I have to match users on Office 365 with SMTP address with the on-premises user objects for sync to work, is that correct? or just normal setup of AAD Connect will work after the migration?
Yes, that's correct. The Cutover migration process uses the mail/WindowsEmailAddress attribute to provision new user accounts, thus they might not match the on-premises UPN value. The process of "matching" them is called soft-match, and is detailed here: https://support.microsoft.com/en-gb/help/2641663/use-smtp-matching-to-match-on-premises-user-accounts-to-office-365
If the UPN value matches the mail attribute on-premises, you should be OK. If not, follow the process detailed above.
That being said, I am planning to add an UPN Suffix to the current environment as domain.com since ours is domain.local at the moment before the migration and AAD Connect. So I guess the information you gave me I should be ok as long as the UPN suffix is domain.com before the directory synchronization.
I am sorry I might be repeating my questions here but i just want to be absolute clear before i proceed with any migration. Thank for your assistance Michev.
@JonVeev
You need to change your domain from .local to .com first, because you must use a certificate issued by a trusted certification authority (CA) with your Outlook Anywhere configuration in order for Microsoft 365 or Office 365 to run a cutover migration. A ".local" domain name isn't supported with trusted CA.
For more detail information, you can have a look about this article: Prepare for a cutover migration
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
I am writing here to confirm with you any update about this thread now?
If the above suggestion helps, please be free to mark it as an answer for helping more people.