Hello,
TLDR; Approx 2 years ago we manually created Cloud users on our 365 Tenant to start using Teams. Now we're trying to sync our on-prem AD with AAD and experiencing issues due to pre-existing Exchange Online mailboxes. Cannot delete the mailbox without deleting the user. Can't delete the user because we don't want to lose anything in Teams. Looking for help.
During the pandemic we had a lot of staff start working remotely. Our existing messaging platform was not up to the task and we jumped on the Teams bandwagon, shortly after we bought a mix of Business Basic and Business Standard licenses for all our staff. When applying the licenses to the staff we also inadvertently assigned an Exchange Online license. No big deal we thought at the time because our corporate email MX records point to our on-prem Exchange servers.
Fast forward to now and we're in the process of trying to sync all on-prem users to Azure AD so we can ultimately migrate our mailboxes off of our on-prem Exchange 2013 servers and on to Exchange Online. We've run into an issue that Microsoft support is having trouble solving. Because the cloud users were manually created before we setup AAD Connect and configured Hybrid Exchange, the Tenant knows nothing about the on-prem mailboxes. I cannot sync on-prem users to our Tenant because a mailbox exists for the user already. I cannot delete the Exchange Online user mailbox without deleting the user. Deleting the user will cause data and permission loss with Teams.
The sync process works fine if the user doesn't exist on the Tenant first, or if the 365 user doesn't have a pre-existing mailbox.
Hoping to find someone who's been in a similar situation and was able to solve it. Information online is sparse for this scenario and I'm not able to find anything that helpful.
Edit: September 25, 2023 - Added more details to the solution for my issue.
Just wanted to update this so if anyone else is having the same issue hopefully it helps them.
During initial tenant setup I created a couple of retention policies. I thought these would only affect Teams data, but it turns out it also applied to Exchange Online mailboxes. When I tried to remove the Exchange Online license from the user it would give an Exchange error message in admin console and the mailbox would not get removed.
The issue turned out to be caused by holds that were applied to the user mailbox. Specifically these two:
DelayHoldAppliedReleaseDelayHoldAppliedBoth were set to $true.
I removed the retention policies, they probably weren't configured correct in the first place.
Used the following Powershell command to identify the holds applied to mailboxes:
Get-Mailbox | FL Identity,*HoldApplied*Set-Mailbox -Identity @mydomain.com -RemoveDelayHoldAppliedSet-Mailbox -Identity @mydomain.com -RemoveDelayReleaseHoldAppliedDelete the user's mailbox by removing the Exchange Online license from the user and waited for the mailbox to disappear from the Exchange Online admin center.
Run the following command to wipe out the pre-existing mailbox data. Without doing this, even after the on-prem user is synced Exchange Online will not care that the user has an on-prem mailbox, and will restore the previously deleted cloud mailbox from step 4.
Set-User @mydomain.com -PermanentlyClearPreviousMailboxInfoForce a sync of users using Azure AD Connect
Re-enable the Exchange Online license for the user. After this is done in the users Mail settings you should see a message "This user's on-premises mailbox hasn't been migrated to Exchange Online. The Exchange Online mailbox will be available after migration is completed"
Thanks to everyone who replied and offered help.
Hey, thanks for circling back and updating! More details here on those mailbox properties in case anyone is curious: https://learn.microsoft.com/en-us/purview/ediscovery-identify-a-hold-on-an-exchange-online-mailbox?view=o365-worldwide#managing-mailboxes-on-delay-hold
So, did you recently remove a hold from these mailboxes? Or were these properties stuck somehow, even though they were more than thirty days old?
Just added more details to the post. Hoping that one day this will help someone else.