Microsoft documents three native ways to move mailboxes from Exchange Server to Exchange Online. They are really three different answers to two questions: do you keep Active Directory as the source of identity, and can you switch everyone at once?
This post lays out what each method actually does, what it needs from your environment, and the situations where each one is the wrong choice.
Cutover migration
A cutover migration copies every mailbox in the organization in one batch, then you point MX at Exchange Online and everyone switches on the same day. Exchange Online creates the cloud accounts for you from the on-prem directory during the initial sync. Directory synchronization must be off while it runs.
It is supported for Exchange 2003 through 2019 and for fewer than 2,000 mailboxes, but in practice it is comfortable up to a couple of hundred. Above that, one switch window and the Outlook profile churn on one morning become hard to support.
The key limitation is identity. After a cutover, the cloud accounts are independent of Active Directory. If you later want to sync AD to Entra ID, you have to match every account by SMTP address, which works but is a second project. Cutover fits companies retiring the domain controller anyway.
- Best for: under about 150 mailboxes, no directory sync, willing to switch on one weekend.
- Needs: Outlook Anywhere reachable from the internet with a trusted certificate, an admin account with full access to every mailbox.
- Watch out for: every user gets a new password and a new Outlook profile on the same day.
New-MigrationEndpoint -ExchangeOutlookAnywhere -Name OnPremEndpoint -Autodiscover -EmailAddress admin@domain.com -Credentials (Get-Credential)
New-MigrationBatch -Name Cutover -SourceEndpoint OnPremEndpoint -AutoStartStaged migration
Staged migration moves mailboxes in groups using a CSV per batch, with directory sync running. It sounds like the moderate option, but it only supports Exchange 2003 and 2007 as the source. If you are on Exchange 2010 or newer it is simply not available.
Where it still applies, it converts each moved mailbox to a mail-enabled user on-prem so that mail forwards to the cloud, and users get new Outlook profiles as their batch completes. If you are on 2007 today, the more common path is to add a newer Exchange server and go hybrid.
Hybrid migration
Hybrid connects the on-prem organization and the tenant into one logical Exchange organization. Entra Connect syncs users and their Exchange attributes to the cloud. The Hybrid Configuration Wizard sets up federation, mail flow connectors, and the Mailbox Replication Service proxy that moves data. Mailboxes then move in batches with the same free/busy, global address list and internal mail routing on both sides.
Moves are online. The data copies in the background while the user keeps working, and when you complete the batch the last delta is synced and the mailbox flips. Outlook notices through Autodiscover and asks the user to restart. Mobile devices on modern Outlook reconnect on their own.
Hybrid is supported from Exchange 2010 SP3 upward, though 2010 and 2013 need a newer coexistence server to run current wizard builds. The setup is the most involved of the three, and it needs a publicly reachable Exchange server with a third-party certificate. In return you get batches, rollback per mailbox, and a clean path to later removing the last server.
- Best for: any organization that keeps Active Directory, or has more than a weekend's worth of data.
- Needs: Exchange 2013 or later reachable on port 443, Entra Connect, a public certificate, the Hybrid Configuration Wizard.
- Watch out for: firewall rules for Microsoft's IP ranges, an Autodiscover record that still points at the wrong host, and mailboxes created in the cloud before sync ran.
New-MigrationBatch -Name Finance -SourceEndpoint "Hybrid Migration Endpoint - EWS (Default Web Site)" -TargetDeliveryDomain contoso.mail.onmicrosoft.com -CSVData ([System.IO.File]::ReadAllBytes("C:\migration\finance.csv")) -AutoStart
Get-MigrationUser -BatchId Finance | Get-MigrationUserStatistics | Select Identity, Status, PercentageComplete, TotalItemsInSourceMailboxCountFull hybrid, minimal hybrid and the Hybrid Agent
Inside hybrid there are choices. Full hybrid sets up everything: federation, free/busy sharing, mail flow, and the move endpoint. Minimal hybrid, sometimes called express, skips the sharing pieces and just gives you directory sync plus mailbox moves. It suits companies that will move everything within a few weeks and do not need cross-premises calendars during the process.
The Hybrid Agent option publishes the move endpoint and free/busy through an agent that makes an outbound connection, so you do not have to open port 443 inbound to Exchange. It does not cover mail flow, which still needs the normal connectors. Pick full hybrid if you expect coexistence for months, minimal hybrid if you are moving fast, and the agent if the network team will not open inbound ports.
A simple decision path
Most organizations can decide quickly once the facts are on the table.
- Exchange 2003 or 2007 and cannot add a newer server: cutover if small, staged if large, third-party tool if neither fits.
- No Active Directory going forward, under about 150 mailboxes, one weekend acceptable: cutover.
- Keeping Active Directory or Entra Connect already running: hybrid, no exceptions.
- Cannot open inbound 443 to Exchange: hybrid with the Hybrid Agent.
- Large public folders or third-party archives: hybrid, plus a plan for those items separately.
Frequently asked questions
Can I do a cutover and turn on directory sync later?
Yes. The cloud accounts must be matched to on-prem accounts by primary SMTP address, and the on-prem accounts need the right Exchange attributes. It works, but plan it as its own change and test with a few users first.
Is hybrid overkill for 40 mailboxes?
Not if you keep Active Directory. The wizard takes an afternoon and the mailbox moves are painless. Cutover saves the setup but costs you a same-day password and profile reset for everyone.
What about third-party migration tools?
They cover cases the native tools cannot: very old Exchange versions, hosted Exchange providers, tenant-to-tenant, and unusual coexistence needs. For a standard on-prem to Exchange Online move they add cost without much benefit.
Takeaway
Pick the method by identity and scale, not by which one sounds simpler. If Active Directory stays, hybrid is the answer and the setup effort pays for itself in the first batch. Cutover is for small shops leaving AD behind. Staged is a legacy option you will rarely need.