chaplic

You using Azure AD, Sorry Entra ID auth? doesnt work in a logical way See Connect to remote Microsoft Entra joined device | Microsoft Learn

Have you looked at Microsoft Bookings? Its basically a front end to a shared mailbox but works well in use cases it supports

Move to the cloud is rarely an argument made purely on cost reasons, unless it's a immediate capex vs ongoing opex argument. You are paying for extra flexibility, (probably) better physical hosting, better connectivity, better DR and the ability to differentiate key services

Just finishing a piece of work to move 2000 servers to azure, some unstructured thoughts Azure firewall has a shocking low limit for outgoing SNAT, maybe not an issue if you just have servers there Moving a server as-is should be the last option in terms of what you do (though if you do azure migrate does a reasonable job of it). If you conclude it's necessary, consider what cloud features you can make use of to reduce costs (ASR, Azure Monitor). Some servers you can grossly under-spec compared to what you have today (and turn them off etc). you may well find some servers have to be beefier. Disk performance for basic disks is poor. I seek to use MS infra tooling (AUM, Monitor, Policy) but be aware it's probably not as feature rich as you are used to and will have to roll out on things on top of it Get your azure policy in there early, especially to stop you /others doing daft stuff like assigning public IPs to servers Only use private endpoints if you want to access the service from inside your LAN via vpn/ expressroute. It travels over the same network and adds complexity Setup cost alerts and a monthly session to review costs Dont build stuff out via the UI, define it as code. Sharp learning curve but much stronger for governance End user computing stuff, in general is better held in Office365 Do you really need multiple geographies? UK south has three Availability zones and makes life much easier. A lot of new stuff doesnt land in uk-west either.

Have you not enabled / disabled TLS1.2 on the AADC server?

Offer to setup a power automate to send a notification email to their personal 'You have a mail in your school account'

On the Azure AD Connect box, find the synchronization service app and dig through sync logs to see if anything shows there UPN is only used for email address if proxyAddresses doesnt have an SMTP:email@address entry so I'd be tempted to try one just to see what happens. when you look at a user with an AzureAD cmdlet vs an Exo cmdlet, is the email address still onmicrosoft? could someting else be using the email address ? contacts?

I'd guess governorhub is using the shared IPs from mail gun rather than their own and it's got a bad reputation, MS have always been a little opaque about how some of this this works, for example you cannot receive email on port 25 from an IP that is believed to be home broadband, no matter how much you allowlist. Sorry, sounds like you need to enjoy the please of MS support..

is it hitting an address still associated with gmail and being forwarded? the governhub email SPF record is set to soft fail which probaby equates to quarantine, but if you can post the email headers suitably redacted we can see if it's a problem at the governrorhub end

"Access to Azure Active Directory" is the key here. This is a on-demand azure subscription created years ago when you had office365 and no Azure subscription. It's nothing to worry about What is the “Access to Azure Active Directory” subscription for? | AAD Support Notes (jasonfritts.me)

Agree with Roberto. I'm nearing completion of a project to close a physical datacentre of about 2000 servers and migrate to the cloud. Moving the server to Azure/ standing up a new one is very much the last option. If it's end user files, teams/onedrive/sharepoint should be your first port of call, then Azure Files Then, using cloud equivalents which might be feature-poorer in some respects but much cheaper than the legacy equivalent (e.g. Azure Load Balancer vs an F5) But assuming we have to move the server there are still things to consider. Could we remove need for a second server and use Azure Site Recovery? Can we turn off boxes overnight or reduce resilency. Can we avoid backup at all for some servers if we can automate and document builds?

Update allows administrators to set additional default mail and calendar synchronization windows for new Exchange accounts in Outlook 2016 - Microsoft Support I know it's possible because I did a project to rollout new PCs on place with comically small bandwidth so we set soemthing up that when the users PC was new it only downloaded X days, then that was increased slowly to desired default. I'm not sure of the behaviour on existing accounts.

Group Policy Preference Regsitry key set to create - users can then change

If it helps I took SIMS on windows 7 in a workgroup, joined it to a domain, upgraded in place to windows 10. Removed it from a domain and Azure AD joined it, upgraded in place to windows 11. Along the way I did a frig so that azure ad joined teacher laptops could access the sims share, but overall it was pretty low drama.

Hmm, I suppose being pedantic they should have left an exchange server in the environment to be supported, though that’s been a nonsense ever since exchange has been in hybrid. All the the attributes for exchange / exchange online are in the AD directory. So, assuming your accounts are still mastered on premise then you’re setting values on prem. So, you can clean up a few permissions that might be lying about, as per what fn-go said and you can nuke server names if there are still in AD but I’m not sure what more you can do.

I think you need to unpack this a little. I think what you are saying is for a given person they have 1) an M365 identify and password 2) a Active Directory (DC) identity and seperate password And you have a mix of Azure AD Joined and AD joined PCs? I am not sure of the value in AD Domain joining machines that are already Azure AD domain Joined, this would be a backwards step compared to most peoples direction of travel. it is possible to access an on premise fileserver with an AAD user account and device. I think what you want to do is sync your own prem AD user accounts to M365 and for those people who already have an account join them up, but need to understand more to be sure.

It’s not in an order, or a specific allow beats a generic deny, the most restrictive policy applies.

To be in hybrid the following are required, off the top of my head 1) Externally autodiscover to be pointing at your Exhange 2016 box 2) Exchange 2016 box to be accepting https connections from big microsoft range for free busy lookups and similar org relationship stiff 3) exchange 2016 box to accept incoming smtp port 25 connection form big MS ip ranges to route mail between O365 and on prem 4) exhange 2016 box to sent email to big o365 ip ranges 5) exchange 2016 box to be able to connect to ms IP ranges on https for free busy lookup and similar. some firewalls dont flatly deny the connection but helpfully show message which is confusing when troubleshooting.

DWservice has been fantastic for me, it’s not quite ‘enterprise ready’ but works brilliantly, you have to raise a ticket it you want to auto install it and it costs peanuts.

Yes it is. But bear on mind you cannot have the same email address or UPN in 2 tenants. So, what you have to do is map another AD field for the sync e.g. AD to tenant 1, UPN is AD syncs to UPN in O365, proxyAddresses syncs to proxyAddresses AD to new tenant, Extension Attribute1 syncs to UPN in O365, carLicense syncs to ProxyAddresses

Have you taken the laptop offline (disabed nics/ wifi) and see if teh files magically appear?

This is giving me a headache for client as we were planning to remove the on prem server and relay all though O365, happily sliding under the limits. Now current plan is to install Exchange 2019(!) so we can get some DLP and then relay out via Azure Communication Services which is straightforward to do. Alas it does seem to do AV scanning (silently gobbled an EICAR far as I can tell) but no other functionality.

Dont forget to setup DKIM, SPF, DMARC and autodiscovery CNAME

As julian implies. The CA Issuing a cert does not magically make any clients trust it. You also need to ensure the name you are referring to it and the certificate name are on-and-the-same. As a test, I would look at the cert properties, export it to file and transfer to test PC. From there run mmc as admin and run certificate services as the computer and import the certifcate into trust root CAs IF the browser is now happy then it implies the computer doesnt trust the CA. If it still doesnt then it may be a naming problem.

Run procmon Run the app as normal user See what is denied when the app runs (e.g. write access to a folder) Give normal users access to it If the app explicitly demands admin rights this wont help but I've had a few sucesses