How to migrate On-Prem Exchange security Group to the cloud ?

Hi Brian Collins

Thank you for reaching out to the Q&A Forum.

Based on Microsoft documentation and my understanding, no native migration utility exists for Security Groups in the way mailbox migration tools operate. These groups synchronize from local Active Directory and remain read-only once visible in the cloud.

Conversion into cloud-only objects requires a manual process. The outline below reflects the standard approach.

Pre-Requisite Check

• Groups tied to on-premises file server permissions (NTFS/ACLs): migration not suitable. The Security Identifier (SID) changes during conversion, resulting in loss of access to local resources.
• Groups tied only to email, Teams, or SharePoint permissions: You may proceed safely.

Here is re step-by-step migration plan you can try:

Since you cannot convert the group while it is synced, the process involves exporting the current data, removing the On-Prem version to break the sync, and recreating it in the cloud.

Export Group Membership (On-Premises)

Run this PowerShell command on your local Domain Controller to save the current members to a CSV file.

$GroupIdentity = "YourGroupName"
Get-ADGroupMember -Identity $GroupIdentity | Select-Object SamAccountName, UserPrincipalName | Export-Csv "C:\temp\GroupMembers.csv" -NoTypeInformation

(Note: Also document the group's Primary SMTP and any Alias addresses)

Remove the On-Premises Group

• Open Active Directory Users and Computers.
• Delete the Security Group (or move it to an OU that is not synced by Azure AD Connect).
• Force a delta sync on your Azure AD Connect server: Start-ADSyncSyncCycle -PolicyType Delta
• Wait for the group to disappear from the Microsoft 365 Admin Center.

Recreate the Group in Exchange Online

• Log in to the Exchange Admin Center (admin.exchange.microsoft.com).
• Navigate to Recipients > Groups > Mail-enabled security.
• Click Add a group and create a "Mail-enabled security" group > Use the exact same Name and Primary Email Address as the old group to ensure mail flow continues. (If the old group had multiple email aliases, add them now under the group settings)

Restore Membership

You can now bulk-add the members back using Exchange Online PowerShell.

Connect-ExchangeOnline
$Members = Import-Csv "C:\temp\GroupMembers.csv"
$GroupName = "YourGroupName"
foreach ($Row in $Members) {    
	Write-Host "Adding user $($Row.UserPrincipalName)"    
	Add-DistributionGroupMember -Identity $GroupName -Member $Row.UserPrincipalName
}

Once completed, the group is fully migrated. You will now manage members and settings directly in the Microsoft 365 Admin Center, and it will no longer depend on your local server.

I hope this information helps and if you need any additional information regarding this matter. Please don’t hesitate to reach out! 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

To migrate on-premises Exchange security groups to the cloud, use Microsoft Entra Group Source of Authority (SOA) and mail-enabling where required, depending on how the groups are used.

1. Identify the type and usage of the on-premises group
   • Plain security group used only for access control to cloud apps/resources.
   • Mail-enabled security group (MESG) used for mail routing and/or access control.
2. For security groups used only for cloud access (no mail)
   • Synchronize the group to Microsoft Entra ID (via Microsoft Entra Connect Sync or Cloud Sync).
   • Use Group SOA to convert the synchronized AD DS security group to a cloud-managed Microsoft Entra security group:
     • After SOA conversion, the group becomes a Microsoft Entra security group (not mail-enabled).
     • Membership and management move to the cloud; Microsoft Entra Connect stops syncing that object from AD DS.
   • Once validated, delete the corresponding group from AD DS if no longer needed on-premises.
3. For security groups that still need an on-prem footprint
   • Ensure the on-premises security group scope is set to Universal.
   • Use Group SOA to convert the group so that it becomes cloud-editable while still having an AD DS presence:
     • Manage membership in the cloud.
     • Use group provisioning from Microsoft Entra ID back to AD DS so that on-prem membership stays in sync.
4. For mail-enabled security groups (Exchange on-premises)
   • Mail-enable the security group on-premises if it is not already mail-enabled; only mail-enabled security groups sync to Exchange Online in a hybrid deployment.
   • After synchronization, the group appears in Exchange Online as a mail-enabled security group:
     • These are managed via Exchange Online or Exchange PowerShell (read-only in Microsoft Entra ID).
   • If email functionality is no longer required, recreate them as Microsoft Entra security groups and use Group SOA to make them cloud-managed.
   • If collaboration features are needed (Teams, SharePoint, shared files/calendars), recreate or upgrade them as security-enabled Microsoft 365 Groups instead of classic mail-enabled security groups.
5. When removing on-premises Exchange dependencies
   • If all user mailboxes are migrated to Exchange Online and apps no longer depend on on-prem mail routing:
     • Use Group SOA to convert Distribution Lists (DLs) and Mail-Enabled Security Groups (MESGs) to cloud-managed objects.
     • Manage them directly in Exchange Online or via Exchange PowerShell.
     • Optionally upgrade DLs to Microsoft 365 Groups to gain modern collaboration features.
6. Best-practice clean-up and modernization
   • For groups used exclusively for cloud access, convert them to cloud-only and remove them from AD DS.
   • For business logic that assigns users to security groups, consider moving that logic into Microsoft Entra ID using dynamic membership groups.
   • Replace legacy self-managed group capabilities (for example, via Microsoft Identity Manager) with Microsoft Entra self-service group management.

References:

• Transition to the cloud
• Guidance for using Group Source of Authority (SOA)
• Embrace cloud-first posture: Convert Group Source of Authority to the cloud
• On-premises security groups are not synced to Exchange Online in a hybrid deployment