How to Perform Exchange Online Cutover Migration with Azure AD Connect
Question details
The user needs to properly handle directory synchronization during a cutover migration from an on-premises Exchange server to Microsoft 365.
- Product
- Microsoft Exchange 2013, Azure AD Connect
- Device & OS
- not provided
- Scenario
- Performing a cutover migration to Microsoft 365 for an organization currently using Azure AD Connect, with plans to remove the on-premises Exchange server.
- Observed behavior
- Directory synchronization must be carefully managed and temporarily disabled to avoid account and mailbox conflicts during the migration process.
Ensure you have global administrator privileges in your Microsoft 365 tenant and enterprise administrator rights in your on-premises Active Directory before modifying directory synchronization settings.
Temporarily Disable Directory Synchronization for Cutover Migration
To prevent mailbox conflicts, you must move users out of the sync scope, turn off Azure AD Connect, perform the migration, and only re-enable it afterward.
Azure AD Connect should generally not be active during a cutover migration. Leaving it on can cause severe account and mailbox provisioning conflicts between your on-premises Active Directory and Microsoft Entra ID (formerly Azure AD).
By systematically moving users out of the synced scope and disabling directory sync, you clear the path for a clean cutover migration. Once the on-premises Exchange server is decommissioned, Azure AD Connect can be safely re-enabled.
In your on-premises Active Directory, temporarily move the synchronized users to a non-synchronized Organizational Unit (OU) that is excluded from Azure AD Connect's scope.
Force a synchronization cycle in Azure AD Connect to update the user objects in Microsoft Entra ID, effectively removing them from the synced state.
Log in to the Microsoft 365 admin center and confirm that the corresponding accounts no longer display as synchronized with on-premises Active Directory.
Use Microsoft 365 PowerShell to completely turn off directory synchronization for your tenant by running the appropriate Set-MsolDirSyncEnabled command.
Proceed with the standard Exchange Online cutover migration steps to move mailboxes from your on-premises Exchange 2013 server to Microsoft 365.
After the migration is fully completed and the on-premises Exchange server is uninstalled, you can safely re-enable Azure AD Connect to resume identity and password synchronization.
Equip Your Migrated Users with WPS Office
After successfully migrating your organization's email infrastructure to Microsoft 365, consider optimizing your endpoint software costs. WPS Office is a lightweight, highly compatible alternative to Microsoft Office that meets all your daily document needs.
- 1. Download WPS Office: Visit the official WPS Office website to download the free enterprise or personal installation package.
- 2. Deploy to Devices: Install the lightweight suite across your organization's endpoints without worrying about heavy resource consumption.
- 3. Open Existing Documents: Instruct users to simply open their existing Word, Excel, and PowerPoint files directly in WPS Office with complete formatting retention.
Frequently Asked Questions
Can I leave Azure AD Connect running during a cutover migration?
No, Azure AD Connect should generally be disabled during a cutover migration. Leaving it active can lead to synchronization errors and mailbox provisioning conflicts between your on-premises environment and Microsoft 365.
Will passwords sync back to Active Directory after the migration?
No, Azure AD Connect synchronization is entirely unidirectional. It synchronizes identities and passwords from your on-premises Active Directory to Microsoft Entra ID, but it does not sync cloud changes back to your local directory.
Is it safe to re-enable Azure AD Connect after uninstalling on-premises Exchange?
Yes. Once the cutover migration is fully complete and you have uninstalled the on-premises Exchange server, you can safely re-enable Azure AD Connect to continue managing identities and passwords without causing conflicts.
