sukh

check message tracking 1st to see if it's delivered.

you can either do a staged or cutover migration this depends on your goal on if you want to have a hybrid solution or not.

All working?

I assume you mean 2 forests as you couldn't have both in the same forest. I would simply do the above and create your user/mbs beforehand.

ask them to save the message and zip and send to you.

correct you can't dk online moves with 2007 only. I assumed you were us 2007.

so you have a on prem deployment but physically located at your ISP'S DC. What type of messages end up in inbox? Can you post/pm the headers of a message which is supposed to be spam?

If you RDP to the server can you see the EMC & EMS?

I wouldn't do an offline defrag, I would create a new DB and moves across to it. This reduces the downtime for your users as the move are performed "online" so no outage. This is preferred than a offline defrag. You will have a new DB to backup. Post the results.

Can you easily reproduce this? If yes, disable the Sophos agent using disable-transportagent and test again.

Something like a script has removed them. Even if you remove the EAP which included @domain.internal would not remove from the recipients. If they are all gone, then it sounds like a script which has run.

Wanted clear confirmation of hosted. I.e is it a tenant or a on prem deployment "hosted" in a DC.

You don't need to code a solution, this is what ADFS does.

Is it hosted exchange deployment or on prem?

Pretty much said above. Hqve you deployed ADFS ?

Did you find out?

I agree with James here. What needs to be clarified is the link that users click on. Is this on a system/webpage internally connected to AD? And the users are they using domain joined pc or not? If not they will be prompted. As for using certs, that's not supported with O365. So in short domain joined pc which users use to connect to owa will honour SSO, even if not connected to network (cached credentials). Hope that makes sense.

no I mean does authenticate with username and password using exit credentials. Not sure how you are trying to do this but what type of a directory do you have? AD DS? Why don't you want the use to access OWA using the name space?

It does but O365 uses User ID and password (UPN) with an option for 2FA. I'm not sure why you don't want to use ADFS and allow users to connect natively using the URL for Web services.

Only ADFS or Shibboleth, nothing else is supported I'm afraid. SAML is what ADFD 2.0 is based on for O365. It can be fairly simple, you just need to make sure you follow the whitepaper above. Do you have any specific questions?

quick look it won't work. You would probably be better using Get-MailboxExportRequestStatistics to see if the export is complete then do the delete.

Some deployment s have it on t same disk, this depends on disk attributes, however that can be expensive and not recommended if you just have 1 exchange server.

5000 emails is nothing, performance is good but really depends on your pipe and latency. Backupless solution. You have retention periods and multiple copies of your DB.

the ndr just says messages is expired, we don't know why. When the sender emails and message is in the que it will give a reason why. What does that say?

you need a hybrid server for which the license is free. Then setup your mx record to go to on prem then configure send connector/relay domain for 0365. http://help.outlook.com/en-us/140/ff633682.aspx#routing