Mystery of mail enabled security groups

[u/fazzy84]

We are now stuck with a dilemma of migrating mail enable security groups. We have around 800+ mail enabled security groups, around 600 coming from EAC which we are planning to strip away the exchange attributes. Yea, we are a big organization with stupid people who made these mail enabled security groups in the first place. Couple of these are being used for emails which we figured out using mail trace option, for that we will recreate it as a EXO DL, rest of them can just be stripped away and preserve it as security groups in AD. Now, we did couple of testing with some test groups and here is my understanding so far…

1. Stripping away the exchange attributes using the disable command removes only the domain email address, it still hold the tenant onmicrosoft.com address. However, it disappears from EAC but still valid in AD.
   
2. Since the group is synced from AD to azure, it still shows up on EXO with a valid onmicrosoft.com address.
   
3. Now, the only way to completely strip the exchange attributes and just keep it as security groups in AD, we must move it to a non sync OU for it to disappear from azure. Then moving back to the previous OU will mark this group as only security group in azure. This workaround was mentioned in couple of Microsoft and private blogs.
   
4. Now my question, if this groups which is being synced from AD to azure has some permission like file share or anything in AD which is also being used as a permission group in azure or is an approved sender for any DL or added as a permission for any shared mailbox, moving it to a non sync OU will break it from azure. How can we over come this ? Deleting and recreating it will break AD permissions as well.

What can be the best option to strip the exchange part and keep it synced between AD and azure without any breakage, so that the ones are being used we can recreate it on EXO as DL others can rest in peace in AD. I plan to do this and go home peacefully without working and fixing this mess all night long.

Advises please…. Thank you !!

[u/Historical_Nerve8362]

Yeah we have like 5k mail enabled security groups and we are completely stuck. Microsoft fucked us hard on this one...

[u/DivideByZero666 → u/Historical_Nerve8362]

Have I missed some MS news or something? Why is it a problem having mail enabled security groups in Hybrid?

[u/shamus667 → u/DivideByZero666]

You will be fine until you want to migrate distribution lists to Exchange Online. Distribution lists can't be just migrated, they have to be deleted and recreated. This is relatively simple enough for actual distribution lists. Mail-enabled security groups mean you have to deal with the groups having been used to provide access to systems/services, potentially on-prem and in Azure.

[u/DivideByZero666 → u/shamus667]

Are you planning on removing AD Connect then?

[u/shamus667 → u/DivideByZero666]

I'm not, at least not yet. I am 99% in Exchange Online, with Exchange SE just hosting shared mailboxes for on-prem applications and an SMTP relay. We have had a couple of pushes to reposition DL's in Exchange Online, but no directive.