Exchange Online Hybrid Migration: Planning & Execution Playbook

Migration Types — Choosing the Right One

For most organisations migrating from Exchange 2016/2019 with more than 150 mailboxes, Full Hybrid is the right choice. It allows you to move mailboxes in waves, maintain calendar free/busy sharing between on-prem and cloud users during coexistence, and provides the cleanest rollback path.

Pre-Migration Checklist

Skipping the pre-migration checks is the primary reason migrations fail mid-execution. Spend a week here:

• Azure AD Connect installed and healthy — all on-prem users must be synced to Entra ID before migration. Run Get-ADSyncScheduler to verify sync is running.
• UPNs match email addresses — on-prem UPN suffix (e.g. @contoso.com) must match a verified domain in Entra ID.
• Exchange certificates valid — the Hybrid server needs a valid SSL certificate from a public CA covering the hybrid-specific names.
• Autodiscover working — test from outside the network using the Microsoft Remote Connectivity Analyzer.
• M365 licences assigned — every mailbox must have an Exchange Online Plan 1 or Plan 2 licence before migration.
• Mailbox sizes catalogued — identify large mailboxes (>50 GB) early; they will extend batch migration times significantly.
• Shared mailboxes, room mailboxes, distribution groups — all must be synced or created in Exchange Online before user mailboxes move.

Hybrid Configuration Wizard

The HCW is a guided tool that configures the trust between your on-prem Exchange organization and Exchange Online. Download it from Microsoft 365 Admin Center → Setup → Exchange Hybrid.

Key decisions during the HCW:

• Classic vs Modern Hybrid: Use Modern Hybrid — it requires no inbound firewall exceptions because it uses Azure Relay. Classic requires port 443 inbound to the Exchange hybrid server.
• Certificate: Select the certificate that covers your Autodiscover and mail FQDNs. A wildcard certificate works well here.
• Hybrid domains: Include all SMTP domains you plan to migrate, including proxy addresses used by your users.

Running Mailbox Migration Batches

After HCW, initiate migration batches from the Exchange Admin Center (EAC) online → Migration → + Add, or PowerShell for scripted control.

# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Create a migration batch from a CSV
New-MigrationBatch -Name "Wave1-Pilot" `
    -SourceEndpoint (Get-MigrationEndpoint "HybridEndpoint") `
    -CSVData ([System.IO.File]::ReadAllBytes("C:\Migrations\wave1.csv")) `
    -AutoStart `
    -AutoComplete `
    -NotificationEmails admin@contoso.com

# Monitor batch progress
Get-MigrationUser -BatchId "Wave1-Pilot" | Select DisplayName, Status, PercentComplete, BytesTransferred

The CSV file format for hybrid migration is simple — one column: EmailAddress with one UPN per row.

Batch sizing recommendations

• Start with a pilot batch of 10–20 mailboxes from your IT team
• Production batches: 50–200 mailboxes depending on average mailbox size and bandwidth
• Schedule large batches to run overnight — first sync (the "seeding") can take hours for large mailboxes
• Use -AutoComplete:$false if you want to control the exact cutover time per batch

DNS Cutover — The Most Dangerous Step

The DNS cutover is the point of no return. Once you update MX, Autodiscover and Outlook Anywhere records to point to Exchange Online, email flows through Microsoft's cloud.

Coexistence Traps to Avoid

These are the issues that catch teams off-guard during the weeks when some users are on-prem and some are in the cloud:

• Free/busy not working: If calendar sharing between on-prem and cloud users is broken, check the Organization Relationship in EAC and verify the Autodiscover endpoints are reachable. Run Test-OrganizationRelationship.
• Meeting invites going to the wrong server: When you move a mailbox, existing calendar delegates may still cache the old server location. Ask affected users to restart Outlook.
• Shared mailboxes with full access: If User A (on-prem) has full access to a shared mailbox (migrated to cloud), this cross-premises delegation breaks. Migrate User A or the shared mailbox in the same batch.
• Send-on-behalf permissions: These are stored differently in cloud vs on-prem. After migration, explicitly re-add Send-on-Behalf grants via PowerShell: Set-Mailbox sharedmbx -GrantSendOnBehalfTo user@domain.com.
• Out-of-office auto-replies not working: Test OOF immediately after each batch. A common issue is the Autodiscover record pointing to on-prem for cloud-migrated users.

Decommissioning On-Premises Exchange

This is the step most projects delay for too long. Exchange servers sitting in a "hybrid" state with all mailboxes migrated are a security liability — they receive patches forever and require continued maintenance.