Creating empty security groups?

Question

In the Cut over migration procedure there is a step regarding setup of empty security groups and cleaning up delegates.  I am confused on the requirement here.  Can I not create security groups later as needed?  Also if delegates are not removed from the on-premise account what are the repercussions?

Create security groups and clean up delegates    Because the email migration service can't detect whether on-premises Active Directory groups are security groups, it can't provision any migrated groups as security groups in Office 365. If you want to have security groups in Office 365, you must first provision an empty mail-enabled security group in Office 365 before starting the cutover migration.

Additionally, this migration method only moves mailboxes, mail users, mail contacts, and mail-enabled groups. If any other Active Directory object, such as user mailbox that is not migrated to Office 365 is assigned as a manager or delegate to an object being migrated, you must remove them from the object before migration.

Answer 1

Hi Paul,

For the question of security groups:

If you have on-premises security groups which need to be migrated, you have to do it as the official document instructs. A cutover migration is a “one-time-for-all” process, which means you cannot do it “later”. If you don’t follow the suggested steps, your security groups may not be migrated at all.

For the question of delegated permissions:

Please be aware that almost all kinds of on-premises mailbox permissions CANNOT be migrated to Exchange Online. If you don’t remove the on-premises delegated permissions, it may not directly affect the migration itself, but follow-up issues may occur when you try to assign any new permissions from Exchange Online after the migration. (It is suggested you set all the required permissions from the online side after the migration.)

Therefore, please follow the steps as our official article suggests.

Thanks,

Allen

Answer 2

Hi Paul,

Is there any further assistance needed? If yes, just feel free to let us know.

Thanks,

Allen

Answer 3

Hi Paul,

Delegate permission includes Send on Behalf, Send As, Full Access, etc. Please remove them before migration.

Regards,

Edward

Answer 4

Maybe I just need clarification on what is meant by Delegated permissions.  Is that the same as Send on Behalf or Full Access?