Share via

Best practice in Onboarding & Offboarding users in a Hybrid OnPremise AD DS & Exchange Online environment?

EnterpriseArchitect 6,301 Reputation points
2022-05-26T12:02:46.29+00:00

Hi People,

I need some best practices and suggestions for Onboarding & offboarding users in a Hybrid AD DS environment.

All of the mailboxes have been migrated to Office 365/Exchange Online, and the on-premise Active Directory DS is synced to Azure using Azure AD connect.

Thanks in advance.

Windows for business | Windows Client for IT Pros | Directory services | Active Directory
Exchange | Hybrid management
Exchange | Hybrid management
The administration of a hybrid deployment that connects on-premises Exchange Server with Exchange Online, enabling seamless integration and centralized control.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments
Answer accepted by question author
  1. Andy David - MVP 159.7K Reputation points MVP Volunteer Moderator
    2022-05-26T13:15:45.99+00:00

    Once the account is deleted from Azure, the license is freed up.
    See for more:
    https://learn.microsoft.com/en-us/answers/questions/578266/when-can-you-remove-the-license-from-a-deleted-o36.html

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 159.7K Reputation points MVP Volunteer Moderator
    2022-05-26T12:12:51.677+00:00

    In a nutshell:

    Onboard:
    Create the AD account on-prem,
    enable the remote mailbox on-prem and let it sync:
    https://learn.microsoft.com/en-us/system-center/orchestrator/enable-remote-mailbox-hybrid?view=sc-orch-2022
    https://learn.microsoft.com/en-us/powershell/module/exchange/enable-remotemailbox?view=exchange-ps
    Enable-RemoteMailbox "Kim Akers" -RemoteRoutingAddress "kima@Company portal .mail.onmicrosoft.com"

    License Account.

    OffBoard:

    Create an OU that is not synced to Azure:
    https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#organizational-unitbased-filtering

    Remove any licenses.
    Disable the account and Move to that OU.

    Disable the remote mailbox on-prem:

    https://learn.microsoft.com/en-us/powershell/module/exchange/disable-remotemailbox?view=exchange-ps 

    Disable-RemoteMailbox "Kim Akers"

    More:
    https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee?view=o365-worldwide

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.