Upgrading Active Directory and moving email off Exchange Server 2013 for 2 companies in the same group

How the brief came about

The task in this case is to replace the older user account and email systems of 2 companies in the same group, while users can still sign in to business systems and send and receive email during the change. Email at the 2 companies runs on Exchange Server 2013 and uses the existing Active Directory servers. The companies' business systems use user accounts from this Active Directory for sign-in.

Active Directory is the gateway to almost every system in an organisation, and email is the main communication channel both internally and with business partners. If these two systems are changed without a sequence of work, users may be unable to sign in to business systems or to send and receive email on the same day.

We took on this work as a contractor under a purchase order from the main contractor in 2025. The details on this page come from the scope of work in the quotation and purchase order. What was actually carried out must be checked against the delivery documents.

Requirements and constraints

The main requirement is that the existing systems must remain usable during the change, and the scope of work clearly separates what the customer is responsible for. The items in the scope of work are as follows.

• The new Active Directory servers must join the existing domain, so that business systems tied to Active Directory remain usable.
• The 2 companies use different email destinations, but the address book must still be able to find the other company's names.
• Microsoft 365 and Windows Server licences are procured by the customer.
• The customer provides system and network information and the list of users to migrate in each round, and handles communication with users, including the Helpdesk, during migration.
• Firewall and Proxy must allow the IP ranges and URLs used by Microsoft 365 before Hybrid is configured.
• Enforcing MFA (multi-factor authentication) may affect sign-in via VPN and to internal business systems.
• The scope excludes migrating archived email files (PST) on user machines, upgrading client operating systems, and day-to-day Helpdesk work.

Why the work plan upgrades Active Directory before migrating email

The work plan upgrades Active Directory first because both Exchange and Microsoft 365 use user accounts from the same Active Directory. If user accounts have values that cannot sync to the cloud, or the existing servers are not ready, the problems carry through to mailbox migration. The scope of work therefore starts with an Active Directory health check and a check of account information with IdFix (a tool that finds values in user accounts that cannot sync to the cloud).

Once user accounts are ready, Microsoft Entra ID Connect (a tool that syncs user accounts from Active Directory to the cloud) syncs the accounts to Microsoft 365, and Exchange Hybrid is then configured so that on-premises Exchange and Exchange Online work together. This allows mailboxes to migrate round by round, while users who have migrated and users who have not can still email each other.

For the 2 companies with different destinations, the scope of work includes a script to sync the address book between the Active Directory environments of the 2 companies. Users of the first company on Exchange Online and users of the second company on Exchange Server 2019 can therefore still look each other up.

Deliverables under the scope of work

The scope under the purchase orders sets the same deliverables for the 2 companies, differing only in the email destination. The items are as follows.

• New Active Directory servers on Windows Server 2022 or newer that join the existing domain and take over the FSMO roles (the main roles that control the domain) from the old machines
• A Microsoft 365 tenant (the company's Microsoft 365 space) linked to the company's domain, with password policy, Password Writeback and MFA
• Microsoft Entra ID Connect for syncing user accounts to the cloud
• Exchange Hybrid, Mail Flow routes, and a script to sync the address book between the 2 companies
• Mailbox migration: the first company to Exchange Online, the second to Exchange Server 2019 in a 3-node DAG (a group of servers that keeps copies of the mailbox databases on several machines)
• Hands-on training for system administrators and the IT Support team, and system documentation

Work sequence and migration in batches

The work sequence under the scope runs from the user account system to the email system, and mailbox migration is divided into rounds, starting with a pilot round. The 2 companies follow the same sequence.

1. 1

   Health check of the existing systems

   Run an Active Directory health check and check user account information with IdFix to find values that cannot sync to the cloud, then prepare user information, contact lists, the address book and Distribution Groups.

2. 2

   Prepare Microsoft 365

   Configure the Microsoft 365 tenant according to the deliverables above, and install Microsoft Entra ID Connect.

3. 3

   Upgrade Active Directory

   Back up the entire Active Directory before starting, add the new servers to the existing domain, transfer the FSMO roles to the new machines, then decommission the old machines.

4. 4

   Configure Exchange Hybrid

   Connect on-premises Exchange with Microsoft 365 in a Hybrid setup, set up the mail routes, and install the script that syncs the address book between the Active Directory environments of the 2 companies.

5. 5

   Mailbox migration in batches

   Migrate pilot mailboxes first, then migrate all of them according to the Migration Batch plan to each company's destination. The Exchange Server 2019 side has separate load-balancing servers.

6. 6

   Testing, decommissioning and handover

   Test with the customer's application team that systems tied to Active Directory remain usable, test email sending and receiving, decommission Exchange Server 2013, train system administrators and the IT Support team, and hand over the system documentation.

Confirmed results

The confirmable result of this case comes from financial documents, not technical measurements. Inspektion holds billing and payment documents from 2026 for the work under the purchase orders of the 2 companies.

There is not yet an acceptance report or technical report to refer to, so this page does not show the number of accounts migrated or other result figures, and it presents the installation, training and documentation items as the scope under the purchase orders.

What we learned

This scope of work offers 3 principles for migrating user account and email systems.

• Correct user accounts before migrating email. Cloud and on-premises email use accounts from the same Active Directory, so the health check and account information check must be finished before syncing, rather than fixing issues during mailbox migration.
• Group companies can choose different email destinations if the address book and mail routes are in the plan from the start. In this work, the address book sync script was in the scope of work from the quotation onwards.
• Decommission old systems only after testing with the business system owners. The sequence of work is pilot, migrate in batches, test with the application team, then decommission Exchange Server 2013.

How can your organisation apply this approach?

If your organisation still runs Exchange Server 2013 or older Active Directory servers, you can use the same sequence of work as this case: check user accounts, upgrade Active Directory, configure Hybrid, then migrate mailboxes in batches. What needs adapting is the email destination and the business systems tied to your organisation's Active Directory.

• Check that you have all the Microsoft 365 and Windows Server licences before work starts
• List the business systems that use Active Directory accounts and the person responsible for each, so they can be tested before the old machines are decommissioned
• Prepare the Firewall and Proxy openings for Microsoft 365 and a plan for communicating with users in each batch