Why it's still there (the honest inventory)
With directory sync, source-of-authority for synced objects is AD: Exchange attributes (proxyAddresses, the recipient plumbing) must be edited SOMEWHERE supported — historically 'keep one Exchange server' was the answer, kept alive for: recipient CRUD, SMTP relay habits, and organisational fear. The Exchange Management Tools path (the schema-and-tools-only install, no running server) made recipient management supported without a live Exchange box for eligible estates — the fear is now the biggest remaining component. (Exchange Server SE's arrival changes licensing/support maths for those keeping a box; it doesn't change the you-might-not-need-one logic.)
The decommission checklist (each item is a concept elsewhere)
- Mailboxes: zero on-prem (arbitration/audit leftovers included — the migration concept's tail).
- Mail flow: nothing routes via the box — connectors, internal apps' smart-host settings (the printer fleet lies; verify by traffic, not by config claims), MX/backup-MX.
- Autodiscover: DNS/SCP truth updated (the stale-rung concept — this step haunts longest).
- Free/busy: org relationships no longer referencing on-prem endpoints.
- Recipient management: the tools path (or your provisioning system writing AD attributes directly) proven for joiner/mover/leaver flows BEFORE the box dies — run a month of real ops on it.
- Then: uninstall properly (not power-off-and-pray — clean removal keeps AD honest), keep the schema tools, archive the certs story.
What to watch (proofs)
- Traffic truth per checklist item: message tracking/netflow on the box for anything still ARRIVING — config says idle, packets decide (two weeks of silence per protocol is the gate).
- The recipient-ops rehearsal log: JML operations executed via the target tooling with screenshots — the nerve-building artifact.
- Autodiscover audit (again): all domains' records post-cleanup — the concept's quarterly check catches this project's leftovers for years.
- The cloud-side scan: serv365's connector/org-config diffs through the decommission — every removed dependency visible as dated change, the project's own evidence trail.