We're preparing to retire our local hybrid identity environment and make Microsoft Entra ID the authoritative source for user identities. Our immediate priority is transferring authority to Entra ID; the longer-term goal is to decommission the domain controllers.
Our environment currently has three Windows Server 2012 R2 domain controllers, a file/print server, an Exchange 2013 server, and a Microsoft Entra Connect server. Mail routing already goes through Microsoft 365, and distribution lists and groups have been moved there, although Exchange and local Active Directory still manage some identity attributes and mailbox-related settings. Directory synchronization is currently one-way, and password writeback is disabled.
All user computers are off the local domain and fully managed through Intune, with no hybrid join configuration. We have no applications that depend on Active Directory. Files have been migrated to OneDrive and SharePoint, printers have been redeployed through Intune, and the file and print servers should no longer be required.
DHCP and DNS will remain on the domain controllers temporarily, with plans to move them to a UniFi firewall later. What sequence would you recommend? Specifically, should we change or remove the Exchange-managed attributes first, transfer user source of authority to Entra ID, disable directory synchronization, or follow a different order? I'm looking for a cautious migration plan that avoids abruptly shutting down anything still needed.
3 Answers
It sounds like most of the difficult work is already complete. The next major identity step is moving the users’ source of authority to Entra ID, but follow Microsoft’s current guidance exactly rather than simply disabling synchronization or deleting the connector. Validate the resulting cloud-managed users, sign-in, licensing, groups, and administrative access before retiring anything.
Do not abruptly remove the domain controllers or uninstall Exchange. Exchange 2013 is long out of support, so use Microsoft’s documented procedure for decommissioning the remaining on-premises Exchange server and confirm that no recipients, attributes, management functions, or mail flow still depend on it. After that, follow the separate Microsoft procedure for retiring Entra Connect.
A conservative order would be to power down genuinely unused file and print services first, leaving them available for rollback for several days. Then complete the supported Exchange retirement process, move the identity source of authority to Entra ID, and only then retire Entra Connect. Keep the domain controllers online while DNS and DHCP still depend on them.
After migrating DNS and DHCP, test name resolution, leases, authentication, management enrollment, and any devices or services that may have been overlooked. Leave the old infrastructure powered down but recoverable for a week or two before disposing of it.
The main item that still needs a design is DNS. If clients must resolve internal RFC1918 addresses or private hostnames, public DNS alone will not replace Active Directory DNS. You’ll need another DNS platform, such as DNS on the firewall or a separate service, and should test forwarding and internal records before shutting down the DCs.
DHCP can move to the firewall if that fits your availability requirements, but remember that many firewall-based DHCP services do not provide failover. The fact that the endpoints are cloud-managed does not remove the need for reliable local DNS and DHCP.
Thanks for pointing this out. We’ll treat DNS and DHCP as separate migration projects and keep the DCs online until both services have been replaced and tested.