@Dashrender said in Managing Distribution Groups in an Exchange Hybrid Environment:

@EddieJennings said in Managing Distribution Groups in an Exchange Hybrid Environment:

I ought to have clarified. DUO MFA comes into play with Outlook for our mailboxes that are in Exchange Online. On-prem mailboxes (the few we have left aren't subject to DUO).

Are those that are left on prem - are they actual users? If so, I'm curious why they can't be migrated?

Eventually all users will be migrated, so, yes, we still have real users on-prem.

This is outside the scope of the original question / scenario, but I've learned a good bit during this process with much of that learning validating a few things I already knew, such as the value of taking the necessary time to plan, and prep the environment for migration (removing unnecessary objects, etc.).

@scottalanmiller said in SSO with Azure & On-Prem AD:

Have not tried that. Would be awesome to see working.

I'd love to have had more time to play with it than being given the go-ahead at 3 pm on Friday to have it done by Tuesday morning at 8 am. After cleaning up the Server 2016 that was an attempt @ ADFS by the on-site that assumed A records are auto-created because Azure is integrated and AD, AD Connect, IIS, and SQL would be "OK" on the same server.

@Mike-Davis said in Azure AD Connect and populating a new AD Forest:

With powershell you can rename a UPN suffix. Pretty easy with powershell:
https://blogs.technet.microsoft.com/canitpro/2015/07/07/step-by-step-changing-the-upn-suffix-for-an-entire-domain-via-powershell/

Thanks @Mike-Davis, this is one of the pieces to the puzzle that I was missing.