View source for Changing Archiving from Microsoft Exchange Server to Microsoft 365

{{#ev:youtube|https://youtu.be/fWm-GaUstZk|350|right|''Tech Tip: Changing Archiving from Microsoft Exchange Server to Microsoft 365''}}
This article shows the changes required in MailStore Server when switching the email environment from a local Microsoft Exchange installation to Microsoft&nbsp;365.

Our Tech Tip video provides an overview. Please note that the actual steps might deviate from those shown in the video based on the current configuration.
<br clear="all">

== Notes and Considerations ==
As with any changes in a production environment, changing archiving in MailStore Server should be planned carefully in advance. Therefore, before implementing any changes, please take the following notes into consideration:
* It is strongly recommended to implement the modifications described in this article in a test environment first because the changes to your Exchange and MailStore Server installations may not be reverted without huge effort if at all.
* Please make sure that you have a current [[Backup_and_Restore|backup]] of your Exchange and MailStore Server installations before applying any modifications to your production environment. For the Service Provider Edition, refer to this [https://help.mailstore.com/en/spe/Backup_and_Restore Backup] article.
* It is recommended to update MailStore Server to the latest version before applying any modifications. Please make sure that your [https://www.mailstore.com/en/products/mailstore-server/faq/ Update and Support Service contract] is valid (not relevant for Service Provider Edition) and take heed of the [[Update_Notices_for_MailStore_Server|update notices]] (MailStore Server) / [https://help.mailstore.com/en/spe/Update_Notices update notices] (Service Provider Edition).
* It is assumed that MailStore Server currently runs in an Active Directory / Exchange Server environment according to the [[Archiving_Emails_from_Microsoft_Exchange|MailStore Implementation Guides for Microsoft Exchange Servers]] and shall run according to the [[Archiving_Emails_from_Microsoft_365_(Modern_Authentication)|MailStore Implementation Guide for Microsoft&nbsp;365 (Modern Authentication)]] hereafter.
* The modifications to the configuration of MailStore Server should be applied in [[MailStore_Server_Service_Configuration#Controlling_the_Service|Safe Mode]] to avoid interference by background tasks or user interaction. For the Service Provider Edition, refer to [https://help.mailstore.com/en/spe/Management_Console_-_General Management Console], section "Safe Mode".
* Disable all scheduled tasks in the Windows Task Scheduler that trigger the directory service synchronization, an archiving process or interfere otherwise with the archive.
* Microsoft&nbsp;365 does not support journal mailboxes hosted within Microsoft&nbsp;365 itself. If you archive all incoming and outgoing emails with MailStore Server, you need a journal mailboxes that is hosted outside Microsoft&nbsp;365. MailStore offers [https://help.mailstore.com/en/gateway/Main_Page MailStore Gateway] as a free solution that can provide journal mailboxes in your company intranet.

== Changing User Synchronization ==
As a first step, you must change the directory services that MailStore Server synchronizes its users with from ''Active Directory'' to ''Microsoft&nbsp;365 (Modern Authentication)''. This is necessary because Microsoft&nbsp;365 uses Microsoft Entra ID instead of a local Active Directory as directory service.

Initially, please run a [[Active_Directory_Integration#Running_Directory_Services_Synchronization|directory services synchronization]] in MailStore Server with the current configuration to make sure that all user data is complete and up-to-date.

== User Name Format ==
The steps required for changing the directory service depend on the [[Active_Directory_Integration#User_Database_Synchronization|user name format]] that is currently being used in MailStore Server for user synchronization with the local Active Directory.
* If you are currently using the ''SAM Account Name'' or the ''User Principal Name (Local Part)'', i.e. a "flat" user name without domain part (e.g.<code>john.doe</code>) as user name in MailStore Server, users and archive folders must be renamed in MailStore Server. In this case, please follow the steps in the next section.
* If you are already using the the full ''User Principal Name'' (''UPN'', e.g.<code>john.doe@example.com</code>) as user name in MailStore Server and
** exactly that UPN will be used to log on to Microsoft&nbsp;365 in the future, you can leave the user names, archive folders and source folders in MailStore Server as is. Please continue directly with the section [[#Changing Directory Service Synchronization to Microsoft&nbsp;365|Changing Directory Service Synchronization to Microsoft&nbsp;365]].
** you want to change the naming scheme of the UPN (e.g. from <code>john.doe@example.com</code> to <code>jdoe@example.com</code> or from <code>jane.doe@example.com</code> to <code>jane.doe@example.org</code>) for logging on to Microsoft&nbsp;365, user names, archive folders and source folders in MailStore Server need to be renamed. In this case, please follow the steps in the next section.

=== MailStore Migration Scripts ===
The modifications in the following sections rely on Windows PowerShell scripts which require Windows PowerShell 3.0 or higher.
* You can download the scripts for MailStore Server  [[Media:MailStoreServerMigrationScripts.zip|here]]; they can be found in the folder <code>migration</code> after extraction. For the MailStore Service Provider Edition, please use [[Media:MailStoreServiceProviderEditionMigrationScripts.zip|these]] scripts instead.
* To use the scripts with MailStore Server, access to the [[Administration_API_-_Using_the_API|MailStore Administration API]] in the [[MailStore_Server_Service_Configuration#Services|MailStore Server Service Configuration]] must be enabled.
* In case of the MailStore Service Provider Edition, [https://help.mailstore.com/en/spe/Accessing_Instances provider access] to the respective instance must be enabled as well.
* Executing the scripts can take several hours or even days depending on the amount of data to be changed. You can estimate the expected total runtime by carrying out a test run with only a subset of users.

=== Renaming Users and Archives in MailStore Server ===
MailStore Server distinguishes users by user name only. For example, <code>john.doe</code> and <code>john.doe@example.com</code> are two different users from a MailStore Server perspective, requiring two user licenses. Furthermore, a user's archive is also associated by user name alone, so that, for a user named <code>john.doe</code>, MailStore always creates an archive ''(Archive) john.doe''. However, once such an archive contains archived emails, it will retain its name even if the associated user name changes.

For these reasons, user names and archive folders in MailStore Server must be equal to the user names of the directory service that MailStore Server synchronizes its users with. Because Microsoft Entra ID uses the full ''User Principal Name'' (''UPN'', usually the primary email address) as user name, you must rename users and archive folders if you are currently using a different user name format or want to change the ''UPN''.

For renaming users and archive folder, please proceed as follows (for the MailStore Service Provider Edition, the files have the prefix ''SPE_'', but act the same way):
* Edit the scripts <code>MSS_1_prepare_users.ps1</code> and <code>MSS_2_update_users.ps1</code> in the PowerShell ISE and adjust the values in the section ''Adjust these values according to your installation'' according to your MailStore Server installation.
* Run the script <code>MSS_1_prepare_users.ps1</code> in the PowerShell ISE with ''F5''.
* The file <code>mailstore-users.txt</code> will be created (in the folder <code>C:\Users\<Your user name>\</code> by default). It contains the current MailStore Server user names.
* Edit this file in a text editor. Change the new user names after the "=", so that the entries look like this:
*; <pre>AD user name=Microsoft&nbsp;365 user name</pre><br/>
*; Example (with changes highlighted)
*; <p style="background-color: WhiteSmoke; padding: 8px 12px 8px 12px;"><code>jane.doe=jane.doe</code><code style="color: blue">@example.com</code><br/></p>
*; <span style="color:red">Please use only lower case for letters in user names.</span> For user names that should not change (e.g. the default ''admin'' user), just leave the corresponding entries as is.
* Save the file <code>mailstore-users.txt</code> that now should contain the current and the future user names.
* Run the script <code>MSS_2_update_users.ps1</code> in the PowerShell ISE with ''F5''.
* The script now renames the users and their archive folder in MailStore Server and also updates the archive folder permissions accordingly.
* Log on as MailStore Server administrator with the MailStore Client and check the new user names and archive folders.
* If the local part of the users' email addresses (the part before the "@") has not changed, you can proceed directly with the steps in section [[#Changing Directory Service Synchronization to Microsoft&nbsp;365|Changing Directory Service Synchronization to Microsoft&nbsp;365]]. Otherwise the source folders may need to be renamed as described in the next section.

=== Renaming Source Folders in MailStore Server ===
The folder level below the archive folders reflects the source from which MailStore Server has archived the emails. In case of Exchange archiving, the folder name consists of the prefix ''Exchange'' and the local part of the email address (the part before the "@"), so that for the email address <code>john.doe@example.com</code> the source folder name in MailStore Server would be ''Exchange john.doe@example.com''.

Source folder names only need to be renamed if '''all''' of the following conditions and requirements are met. Otherwise you can proceed directly with the steps in section [[#Changing Directory Service Synchronization to Microsoft&nbsp;365|Changing Directory Service Synchronization to Microsoft&nbsp;365]].
* The local part of the email address shall be changed in course of migrating to Microsoft&nbsp;365 (e.g. from <code>john.doe@example.com</code> to <code>j.doe@example.com</code>) '''and'''
* both the emails that have been archived so far from the local Exchange Server and those that will be archived  from Microsoft&nbsp;365 henceforth should appear in the same folder structure on source level (e.g. so far in ''Exchange john.doe'' and in ''Exchange j.doe'' after).

For renaming the source folders, please proceed as follows:
* Enable access to user archives by administrators in MailStore Server; it is disabled by default. Changing this option is described in chapter [[Compliance_General#Archive_Access|Compliance General]] of the MailStore Server manual.
* Edit the scripts <code>MSS_3_prepare_folders.ps1</code> and <code>MSS_4_update_folders.ps1</code> in the PowerShell ISE and adjust the values in the section ''Adjust these values according to your installation'' according to your MailStore Server installation.

* Run the script <code>MSS_3_prepare_folders.ps1</code> in the PowerShell ISE with ''F5''.
* The file <code>mailstore-folders.txt</code> will be created (in the folder <code>C:\Users\<Your user name>\</code> by default). It contains the full paths of the current source folders that consist of user names and the source folder names, separated by "/".
* Edit this file in a text editor. Change the new source folders after the "=", so that the entries look like this:
*; <pre>Old source folder path=new source folder path</pre><br/>
*; Example (with changes highlighted)
*;<p style="background-color: WhiteSmoke; padding: 8px 12px 8px 12px;"><code>j.doe@example.com/</code><code style="color: red">Exchange jane.doe</code><code>=j.doe@example.com/</code><code style="color: blue">Exchange j.doe</code><br/></p>
*; For source folders that should not change, just leave the corresponding entries as is.
* Save the file <code>mailstore-folders.txt</code> that now should contain the current and the future source folders.
* Run the script <code>MSS_4_update_folders.ps1</code> in the PowerShell ISE with ''F5''.
* The script now renames the source folders in MailStore Server.
* Log on as MailStore Server administrator with the MailStore Client and check the new source folders.

=== Changing Directory Service Synchronization to Microsoft&nbsp;365 ===
To enable users to log on to MailStore Server with their Microsoft&nbsp;365 credentials instead of their Active Directory, you must switch the directory service synchronization to ''Microsoft&nbsp;365 (Modern Authentication)''. Please follow the steps in chapter [[Synchronizing User Accounts with Microsoft 365 (Modern Authentication)]] of the MailStore Server manual.
Initially, just test the synchronization using the ''Test Settings'' button. Check the directory service synchronization results, migrated users should show as ''modified''. You can also check that user authentication against Microsoft&nbsp;365 works as expected.

== Changing the Archiving Profiles ==
For archiving Microsoft&nbsp;365 mailboxes, MailStore Server offers dedicated Microsoft&nbsp;365 archiving profiles that support modern authentication. Existing Exchange archiving profiles cannot be used for archiving Microsoft&nbsp;365 mailboxes because they only support basic authentication.

=== Deactivating Existing Profiles and Jobs ===
If you run MailStore Server in [[MailStore_Server_Service_Configuration#Controlling_the_Service|Safe Mode]] as recommended before, automatic execution of archiving profiles and by jobs is disabled (for the Service Provider Edition: [https://help.mailstore.com/en/spe/Management_Console_-_General Management Console], Safe Mode). To deactivate them permanently, please proceed as follows:
* Log on as MailStore Server administrator through the MailStore Client.
* Click on ''Archive E&#8209;mail''
* Below the profiles list, enable the option ''Show Profiles of All Users''.
* Switch every Exchange archiving profile to ''Manual'' through the context menu.
* If you have configured Exchange export profiles, click on ''Export E&#8209;mail'' in the menu tree and repeat the previous steps.
* If you have configured scheduled job for running Exchange profiles, click on ''Administrative Tools > Management API > Jobs'' and deactivate every job that run an Exchange profile through the context menu.

=== Creating new Microsoft&nbsp;365 Profiles ===
Create new Microsoft&nbsp;365 profiles and jobs according to the following articles. They should be set to manual initially to check their execution and results.
* For archiving Microsoft&nbsp;365 mailboxes, follow the implementation guide [[Archiving_Emails_from_Microsoft_365_(Modern_Authentication)|Archiving Emails from Microsoft&nbsp;365 (Modern Authentication)]].
* Creating Microsoft&nbsp;365 export profiles is described in chapter [[Exporting Email]] of the MailStore Server manual.
* Once the profiles have been set up you can update existing jobs as described in chapter [[Jobs#Properties|jobs]] of the MailStore Server manual.

== Finalizing the Migration ==
To finalize the migration in MailStore Server, please proceed as follows:
* Close all MailStore Client sessions and restart the MailStore Server service.
* Log on as MailStore Server administrator again through the MailStore Client.
* In the main menu tree, go to ''Administrative Tools > Users and Archives > Archives'' and check the names of the archive folders.
* Switch to ''Archive E&#8209;mail'' and run each Microsoft&nbsp;365 archiving profile manually. If you are satisfied with the results, you can delete the old Exchange archiving profiles.
* If applicable, repeat the previous step for export profiles and jobs.
* If you have previously enabled access to user archives by administrators in MailStore Server as described in chapter [[Compliance_General#Archive_Access|Compliance General]], revert that change.
* If you have enabled ''Single-Sign-On (SSO)'' by setting the server name of the MailStore Server computer and the authentication method to ''Windows Authentication'' through group policies [[MailStore_Client_Deployment#Configuring_Policy_Settings|for the MailStore Client]] or the [[MailStore_Outlook_Add-in_Deployment|for the MailStore Outlook Add-in]], you must change the group policy setting ''Authentication'' to ''Standard Authentication''.
* During login, the MailStore Web Access, MailStore Clients and Outlook Add-In call the default web browser to have the user log in through the Microsoft 365 login dialog; this communication is TLS-encrypted via HTTPS. Therefore, for a better user experience, it is recommended to configure an SSL certificate in MailStore Server that is trusted by the web browser. Further information can be found in the [[Using_Your_Own_SSL_Certificate|Using Your Own SSL Certificate]] article (for the Service provider Edition: [https://help.mailstore.com/en/spe/Replace_Self-signed_SSL_Certificates Replace Self-Signed SSL Certificates]).

After finishing these tasks successfully, the migration in MailStore Server is complete.
[[de:Umstellung_der_Archivierung_von_Microsoft_Exchange_Server_auf_Microsoft_365]]
[[en:Changing_Archiving_from_Microsoft_Exchange_Server_to_Microsoft_365]]