📧 Exchange Online Course · Module 6 of 7
Migration & Mobile Device Access
MS-203 Exam Alignment
MS-203
Plan and manage Exchange Online — Migration and Mobile Device Access: identify the correct migration type for a given scenario, create and monitor migration batches, configure mobile device mailbox policies, manage device access rules, and issue remote wipes.
- Distinguish the six migration types by trigger criteria — source system, mailbox count, hybrid requirement, and coexistence need
- Know what the EAC Home "Latest 5 batches" card shows and what "No data available" indicates
- Understand the Mailbox Replication Service (MRS) role in hybrid migrations
- Configure a Mobile Device Mailbox Policy with PIN, encryption, and wipe-on-failure settings
- Know the difference between a full remote wipe and an account-only wipe, and when each is appropriate
Exam Tip: MS-203 migration questions almost always hinge on ONE key detail — source system, mailbox count, or hybrid requirement. Know this matrix: Cutover = Exchange 2010+, <2,000 mailboxes, no hybrid. Staged = Exchange 2003/2007, waves, requires AD sync. IMAP = email only, any IMAP source. Hybrid (MRS) = full fidelity, bidirectional, requires HCW. Know it cold.
The EAC Migration section manages the movement of mailboxes into Exchange Online. The Home dashboard "Latest 5 batches" card tracks active work in real-time. The Mobile section governs how smartphones connect via Exchange ActiveSync. Both are regularly tested in MS-203 through scenario-recognition questions where identifying the right type or policy is the entire challenge.
🔄 Migration Types — Full Comparison
| Type | Source System | What Migrates | Hybrid Needed | Mailbox Limit | Waves |
|---|---|---|---|---|---|
| Cutover | Exchange 2010 / 2013 / 2016 on-prem | Mailboxes, contacts, distribution groups, OOO | No | < 2,000 | Single batch |
| Staged | Exchange 2003 / 2007 on-prem | Mailboxes only (groups must be recreated manually) | No — needs AD Sync | No limit | Multiple batches |
| IMAP | Any IMAP server (Gmail, Zimbra, Lotus Notes) | Email only — no calendar, contacts, tasks, or rules | No | 500K items/mailbox | Multiple batches |
| Hybrid (MRS) | Exchange 2010+ on-prem | Full mailbox — calendar, contacts, rules, folder structure | Yes — HCW required | No limit | Multiple (bidirectional) |
| Cross-Tenant | Another Microsoft 365 tenant | Full mailbox content | No (tenant trust) | No limit | Multiple batches |
| Google Workspace | Google Workspace (G Suite) | Email, calendar, contacts via Migration Manager | No | No limit | Multiple batches |
⚠️ Cutover vs Staged — The Exam Differentiator
Cutover requires Exchange 2010 or later, migrates everything in one go, and is limited to under 2,000 mailboxes. Staged is the only option for Exchange 2003/2007 sources, supports waves over months, and requires Azure AD Connect (DirSync) for coexistence management. When the source is Exchange 2007 — the answer is always Staged, regardless of mailbox count.
📊 Migration Batch Status Lifecycle
| Status | What It Means | Admin Action |
|---|---|---|
| Created | Batch defined, not yet started | Review CSV, then start the batch |
| Syncing | Initial data copy in progress | Monitor — large mailboxes can take hours |
| Synced | Initial copy complete; incremental sync every 24 hrs | Schedule cutover, then run Complete-MigrationBatch |
| Completing | Final delta sync in progress before cutover | Monitor — should finish in minutes |
| Completed | All mailboxes moved successfully | Update MX/Autodiscover, refresh Outlook profiles |
| Failed | One or more mailboxes failed | Review per-user errors, fix root causes, retry |
🖥️ Migration Portal & PowerShell
EAC › Migration › + Add migration batch
🏠 Home
👤 Recipients
📧 Mail flow
🔑 Roles
🔄 Migration
📱 Mobile
📊 Reports
Migration
+ Add migration batch
+ Add migration batch
PowerShell — Create, Monitor & Complete Migration Batches
Connect-ExchangeOnline # Create an IMAP batch (works with Gmail, Zimbra, any IMAP source) New-MigrationBatch -Name "IMAP-Wave1" -SourceEndpoint (Get-MigrationEndpoint -Identity "Gmail-IMAP") -CSVData ([System.IO.File]::ReadAllBytes("C:\migration\wave1.csv")) -AutoStart # Create a Hybrid (MRS) batch — full fidelity, Exchange to Exchange Online New-MigrationBatch -Name "Hybrid-Wave1" -SourceEndpoint (Get-MigrationEndpoint -Identity "HybridEndpoint") -CSVData ([System.IO.File]::ReadAllBytes("C:\migration\wave1.csv")) -TargetDeliveryDomain "techcareers.mail.onmicrosoft.com" -AutoStart # Monitor all batches at a glance Get-MigrationBatch | Select-Object Identity,Status,TotalCount,SyncedCount,FailedCount # Per-user detail for a specific batch Get-MigrationUser -BatchId "Hybrid-Wave1" | Select-Object Identity,Status,PercentComplete,Error # Complete a Synced batch (final delta sync + cutover) Complete-MigrationBatch -Identity "Hybrid-Wave1" # Remove completed batch from the list Remove-MigrationBatch -Identity "IMAP-Wave1" -Confirm:$false
📱 Mobile Device Access
The EAC Mobile section manages smartphone and tablet connections via Exchange ActiveSync (EAS). It has three areas: Mobile device mailbox policies, Device access rules, and per-device management (quarantine, wipe).
Mobile Device Mailbox Policies
A policy defines the security requirements a device must satisfy before it can sync. Each mailbox has one assigned policy; the Default policy applies to all mailboxes without an explicit assignment.
| Setting | What It Enforces | Recommended |
|---|---|---|
| PasswordEnabled | Requires a PIN or password to unlock | $true |
| MinPasswordLength | Minimum PIN/password characters | 6 |
| AlphanumericPasswordRequired | Forces letters + numbers (not digits only) | $true |
| MaxInactivityTimeLock | Minutes idle before screen locks | 5 |
| DeviceEncryptionEnabled | Requires device storage encryption | $true |
| MaxDevicePasswordFailedAttempts | Wrong PINs before automatic device wipe | 10 |
| AllowSimplePassword | Allows patterns like 1111 or 1234 | $false |
| DevicePasswordExpiration | Days before PIN must change (0 = never) | 90 |
PowerShell — Mobile Device Mailbox Policy
Connect-ExchangeOnline # Create corporate mobile device policy New-MobileDeviceMailboxPolicy -Name "Corporate-MDM" -PasswordEnabled $true -MinPasswordLength 6 -AlphanumericPasswordRequired $true -MaxInactivityTimeLock 5 -DeviceEncryptionEnabled $true -MaxDevicePasswordFailedAttempts 10 -AllowSimplePassword $false -DevicePasswordExpiration 90 # Assign to a specific mailbox Set-CASMailbox -Identity user@techcareers.in -ActiveSyncMailboxPolicy "Corporate-MDM" # Apply to all mailboxes at once Get-Mailbox -ResultSize Unlimited | Set-CASMailbox -ActiveSyncMailboxPolicy "Corporate-MDM" # Verify assignment Get-CASMailbox -Identity user@techcareers.in | Select-Object DisplayName,ActiveSyncMailboxPolicy
Device Access Rules
Device access rules allow or block specific device types regardless of the mailbox policy. Each rule is evaluated on DeviceOS, DeviceFamily, or DeviceModel.
| Access Level | Effect | Use Case |
|---|---|---|
| Allow | Device syncs immediately on first connection | Corporate-approved OS versions (e.g. iOS 17+) |
| Block | Device receives access-denied error — cannot connect | Unsupported or insecure OS versions |
| Quarantine | Device held pending admin review — user cannot sync until approved | Unknown/new devices requiring vetting before access |
Full Wipe vs Account-Only Wipe
⚠️ Critical Distinction — Wipe Types
- Full remote wipe (Clear-MobileDevice) — Erases the entire device back to factory settings. All data, apps, and accounts removed. Use for lost/stolen corporate-owned devices. Cannot be undone.
- Account-only wipe (selective wipe) — Removes only the corporate Exchange account and its data. Personal data stays intact. Use for BYOD devices when an employee leaves. Available via Intune or EAS selective wipe depending on enrolment type.
PowerShell — Device Inventory, Access Rules & Remote Wipe
Connect-ExchangeOnline # List all devices synced to a mailbox Get-MobileDeviceStatistics -Mailbox user@techcareers.in | Select-Object DeviceFriendlyName,DeviceOS,DeviceId,LastSyncAttemptTime,Status # Block a specific Android version organisation-wide New-ActiveSyncDeviceAccessRule -Characteristic DeviceOS -QueryString "Android 10" -AccessLevel Block # View current device access rules Get-ActiveSyncDeviceAccessRule | Select-Object Name,Characteristic,QueryString,AccessLevel # Issue a FULL remote wipe (IRREVERSIBLE — erases entire device) Clear-MobileDevice -Identity "user@techcareers.in\DeviceID" -Confirm:$false # Verify wipe status Get-MobileDeviceStatistics -Mailbox user@techcareers.in | Where-Object DeviceId -eq "DeviceID" | Select-Object Status,LastSyncAttemptTime
💡 Best Practices
- Always choose migration type based on the source system first — IMAP is the only option for non-Exchange systems like Gmail and Zimbra
- Run a small pilot batch (10–20 mailboxes) before the main wave to surface per-user errors early
- Monitor FailedCount daily during active migration — failed users don't receive new email during the move until the failure is resolved
- Keep individual batch sizes under 200–300 mailboxes for hybrid migrations to keep monitoring and rollback manageable
- Configure and assign the Default mobile device policy before the first mobile user connects — retroactive policy changes force a full device re-enrolment cycle
- For BYOD, always use account-only (selective) wipe — a full wipe of a personal device creates legal liability and destroys employee goodwill
- Always look up the device ID via Get-MobileDeviceStatistics before issuing Clear-MobileDevice — wipes cannot be undone
🎓 Interview Q&A
Q: What migration type would you use to migrate 1,500 mailboxes from Exchange 2016 on-premises to Exchange Online, without a hybrid configuration, all at once?
Cutover migration. Cutover supports Exchange 2010 and later, requires no hybrid infrastructure, migrates all mailboxes in a single batch, and 1,500 is within the 2,000 mailbox limit. If the count exceeded 2,000 or coexistence was needed for months, Hybrid (MRS) would be the correct answer instead.
Q: A migration batch has been in "Synced" status for 48 hours. The cutover window is tonight. What must you do?
Run Complete-MigrationBatch (or click Complete in the EAC). "Synced" means the initial copy is done but the batch is paused waiting for an admin to trigger the final delta sync and cutover. Batches never complete automatically — this is intentional so admins control the exact cutover timing. Once Complete is called, the batch enters "Completing" (final sync) then "Completed".
Q: A user's personal BYOD iPhone with corporate email was reported stolen. Which wipe type should you issue and why?
Issue an account-only (selective) wipe — not a full remote wipe. A full wipe erases all personal data (photos, apps, messages) which creates legal liability and destroys the employee's personal content without consent. A selective wipe removes only the corporate Exchange account and its mail data, leaving the personal device intact. Selective wipe is available via Microsoft Intune or EAS account removal depending on device enrolment type.
Q: What is the MRS Proxy and what role does it play in a hybrid migration?
The Mailbox Replication Service (MRS) Proxy is an endpoint configured on the on-premises Exchange Client Access Server (CAS) by the Hybrid Configuration Wizard (HCW). It acts as the bridge for data transfer — Exchange Online connects to the MRS Proxy to read source mailbox data and copy it to the cloud. MRS also handles delta syncs (incremental updates) right up to the final cutover point. The MRS Proxy endpoint URL is what you reference when creating a Hybrid migration batch source endpoint.
Q: A new user's phone is quarantined when they try to set up corporate email. What does this mean and what are the admin options?
A quarantined device has been detected by Exchange Online but is not permitted to sync because no device access rule explicitly allows it and the default access level is set to Quarantine. The user cannot receive email on the device until an admin acts. Admin options: Allow (permit sync immediately), Block (permanently prevent access with an error), or Delete the quarantine entry (device re-requests access on next sync attempt). Quarantine is used as the default to give admins visibility and control over which devices access corporate email.
🎯 MS-203 Mock Test
Module 6 — Migration & Mobile Device Access
Question 1 of 5
An organisation is migrating from Exchange 2007 on-premises to Exchange Online. There are 3,000 mailboxes and migration must happen in department waves over 3 months. Azure AD Connect is already deployed. Which migration type is correct?
✅ Correct answer: C. Staged migration is purpose-built for Exchange 2003/2007 sources, supports multiple waves over an extended timeline, and requires Azure AD Connect — which is already in place. Cutover (A) does not support Exchange 2007. Hybrid (MRS) requires Exchange 2010 or later. IMAP (D) migrates email only and does not support Exchange-to-Exchange coexistence.
Question 2 of 5
A migration batch has been in "Synced" status for two days. The admin needs to cut over the mailboxes tonight. What must they do?
✅ Correct answer: A. A "Synced" batch is intentionally paused — waiting for admin action before cutover. The admin must explicitly run Complete-MigrationBatch to trigger the final delta sync and move the mailboxes. Batches never complete automatically. This design gives admins full control over the cutover timing.
Question 3 of 5
You need to migrate email from 500 Google Workspace accounts to Exchange Online. Calendars and contacts are not required — email only. Which migration type is appropriate?
✅ Correct answer: B. IMAP migration works with any IMAP-capable mail server including Google Workspace. Since only email is required, IMAP's email-only limitation is acceptable here. Hybrid MRS (A) only works with on-premises Exchange sources. Staged (C) and Cutover (D) are Exchange-to-Exchange migrations only and do not support Google Workspace as a source.
Question 4 of 5
A corporate-owned phone containing sensitive business data has been reported lost. What is the correct immediate action?
✅ Correct answer: D. For a lost corporate-owned device with sensitive data, a full remote wipe (Clear-MobileDevice) is correct — it erases everything and returns the device to factory settings. Since it is company-owned, there is no personal data concern. An account-only wipe (C) would leave all other data on the device accessible without a network connection. Blocking (A) only stops future syncs but doesn't secure existing data already on the device.
Question 5 of 5
A mobile device mailbox policy requiring a 6-character alphanumeric PIN was created. A user reports their phone only asks for a 4-digit numeric PIN. What is the most likely cause?
✅ Correct answer: A. The most common cause is the policy not being assigned. Set-CASMailbox -ActiveSyncMailboxPolicy must be run for each mailbox (or all mailboxes) — without this, the Default policy applies, which typically has weaker or no PIN requirements. Verify with: Get-CASMailbox -Identity [user] | Select-Object ActiveSyncMailboxPolicy.
🔒
This module is lockedComplete Module 5 and pass its mock test to unlock this module.