You are the Microsoft 365 administrator for a company. The company runs SharePoint Server and Exchange Server in an on-premises datacenter. The site collection for the finance department is currently

Microsoft 365 provides built-in encryption at rest and in transit for both SharePoint Online and Exchange Online, which means the finance department's data can be migrated and remain encrypted without relying on third-party software. Since Microsoft 365 natively supports encryption capabilities (including sensitivity labels, Microsoft Purview, and service-level encryption), there is no technical barrier preventing the migration of all SharePoint data and Exchange mailboxes. The goal is to move as many services as possible, and all services can be moved in this scenario.

There is no requirement to keep finance department SharePoint data on-premises since Microsoft 365 provides native encryption that can replace the third-party encryption.

Leaving Exchange mailboxes on-premises for finance users is unnecessary because the encryption concern applies to the SharePoint site collection, not Exchange, and even the SharePoint data can be migrated.

Keeping both SharePoint data and mailboxes on-premises for finance users is overly conservative and does not maximize migration to Microsoft 365, since Microsoft 365 natively supports encryption for both services.