Exchange Hybrid: How It Works, Setup & Requirements

This is the reference our Exchange hybrid support team uses to explain hybrid deployments: what an Exchange hybrid connects, what the Hybrid Configuration Wizard actually configures, the difference between full, minimal, and Modern Hybrid, current version requirements, and the issues that show up after setup.

What Exchange hybrid is

An Exchange hybrid deployment connects an on-premises Exchange organization and Exchange Online so the two behave as a single organization under one SMTP namespace. Microsoft documents the model in Exchange Server hybrid deployments. In a working hybrid:

• One address space. Mailboxes exist in both environments under the same domains; the global address list is shared.
• Secure mail flow. Messages between on-premises and cloud mailboxes route over TLS connectors and are treated as internal.
• Free/busy and calendar sharing. Users in either environment see availability for users in the other, via an organization relationship or OAuth.
• Native mailbox moves. The Mailbox Replication Service (MRS) moves mailboxes to and from Exchange Online with the Outlook profile intact — no PST export.
• Unified management. The on-premises Exchange admin center shows both environments; recipient attributes are edited on-premises and sync to the cloud.

When you need hybrid

• Staged or long-running migrations. Any migration that moves mailboxes in batches over weeks or months, with coexistence between waves. Smaller cutovers can use the lighter variant covered in our minimal hybrid migration guide.
• Permanently retained on-premises mailboxes. Regulatory, application, or latency requirements that keep some mailboxes on local servers indefinitely.
• Directory-synchronized attribute management. When Entra Connect syncs Active Directory to the cloud, Exchange attributes on synced objects must be edited on-premises with Exchange tools — hybrid (or at least the Exchange management tools) is the supported way to do that.
• Offboarding capability. Hybrid moves work in both directions; it is the only migration method that supports moving mailboxes back from Exchange Online.

The Hybrid Configuration Wizard

The Hybrid Configuration Wizard (HCW) is a downloadable application that runs the configuration on both sides. It creates a HybridConfiguration object in on-premises Active Directory, gathers topology data from both organizations, verifies prerequisites (server versions, directory sync, accepted domains, certificates, Web Services virtual directories), and then executes the configuration tasks. Depending on the options selected, HCW configures:

• Send and Receive connectors for TLS mail flow between on-premises Exchange and Exchange Online
• OAuth authentication between the two organizations
• A federation trust and organization relationship for free/busy and calendar sharing
• The MRS migration endpoint used for mailbox moves
• Email address policies and accepted domain configuration
• Organization Configuration Transfer — copies selected on-premises settings to Exchange Online

Running HCW requires Organization Management on-premises. In Exchange Online, first-time hybrid configuration requires Global Administrator; updates to an existing configuration can run with lower roles depending on topology.

Full vs minimal vs Modern Hybrid

HCW offers a Classic topology (Minimal, Express, Full) and a Modern topology (Minimal, Full) that uses the Hybrid Agent. The differences are documented in Hybrid Configuration wizard options:

• Full classic — the complete feature set: connectors, OAuth, federation, free/busy, MailTips, message tracking, cross-premises search. The right choice for long-term coexistence.
• Minimal — recipient administration and MRS migration only. No hybrid mail flow connectors, no free/busy. Suited to quick migrations where coexistence features are not needed.
• Modern Hybrid (Hybrid Agent) — the Hybrid Agent is built on Entra application proxy technology and tunnels free/busy and migration traffic outbound, removing the need for inbound 443, external EWS DNS records, and a public certificate on EWS. Constraints: hybrid modern authentication is not supported, message tracking and multi-mailbox search do not traverse the agent, a single registered server is a single point of failure unless additional agents are installed, and SMTP still requires a public certificate and port 25 — mail flow is out of the agent's scope.

Requirements

Current prerequisites are listed in Hybrid deployment prerequisites:

• Supported Exchange version. Exchange 2016 and 2019 reached end of support on October 14, 2025. The supported hybrid server today is Exchange Server Subscription Edition (SE); hybrid requires the latest cumulative update (or the immediately previous one). Exchange 2019 CU15 upgrades in place to SE — details in our Exchange Server SE overview. At least one Mailbox server is required; Edge Transport is optional for perimeter mail flow.
• Microsoft 365 plan with directory sync support. Business and Enterprise plans qualify; Entra Connect or cloud sync must be running.
• Verified custom domains added to the Microsoft 365 tenant.
• Certificates. A certificate from a public CA covering the Autodiscover and mail flow namespaces, per certificate requirements for hybrid deployments. Self-signed certificates are not valid for hybrid transport or federation.
• Network. Classic topology: inbound TCP 443 to on-premises Exchange for Autodiscover, EWS, and MRS, plus TCP 25 in both directions for mail flow. Modern topology removes the inbound 443 requirement but not port 25. Exchange SE additionally uses outbound 443 to the Microsoft Graph endpoint for the dedicated Exchange hybrid app that now backs free/busy, MailTips, and photos.
• Autodiscover DNS records for hybrid SMTP domains pointing at on-premises Exchange until migration completes.

Hybrid mail flow: centralized vs direct

Outbound routing is a deliberate choice in HCW, documented in transport routing in Exchange hybrid deployments:

• Direct (default). Exchange Online mailboxes send internet mail straight out through Exchange Online Protection; on-premises mailboxes send through the on-premises route. Simplest, and the correct choice for most organizations.
• Centralized mail transport. All outbound mail from Exchange Online routes back through the on-premises servers before reaching the internet. Used when a compliance gateway, DLP appliance, or regulatory requirement forces every message through on-premises infrastructure. It adds latency and keeps the on-premises transport stack in the critical path, so Microsoft recommends it only for organizations that specifically need it.

Inbound mail can point at either environment; MX typically moves to Exchange Online once the majority of mailboxes have migrated.

Free/busy troubleshooting basics

Cross-premises availability, described in shared free/busy in Exchange hybrid deployments, depends on Autodiscover, EWS, and OAuth or federation all working. When lookups fail, check in this order: confirm the organization relationship and IntraOrganizationConnector are enabled on both sides; test OAuth with Test-OAuthConnectivity against the EWS endpoint; verify the external Autodiscover and EWS URLs resolve and present a valid public certificate; and confirm the target addresses being queried are the routing addresses the organization relationship expects. One-way failures (cloud users see on-premises free/busy but not the reverse, or vice versa) almost always mean one direction's connectivity or authentication path is broken while the other still works — test each direction separately.

The last Exchange server question

After every mailbox moves to Exchange Online, one on-premises requirement remains: Exchange attributes on directory-synchronized objects must still be edited with on-premises Exchange tools, not Active Directory editors. Three supported options exist:

• Keep one Exchange server for recipient management. Still supported, and required if you use the on-premises EAC or Exchange RBAC.
• Exchange Management Tools (EMT). Per manage recipients with Management tools, you can install the management tools on a domain-joined machine, shut down the last server, and manage recipients through PowerShell. The server must be shut down, never uninstalled — uninstalling removes Active Directory objects the tools depend on.
• Source of Authority transfer. The newer path: transfer Exchange-attribute management for synced objects to Exchange Online, after which the last server can be fully decommissioned. Microsoft now recommends moving from EMT to cloud-based attribute management before uninstalling.

Common issues

• HCW fails at connector creation because the certificate on the Send/Receive connector does not match the FQDN entered in the wizard
• HCW completes but mailbox moves fail — MRS proxy endpoint disabled on the EWS virtual directory, or inbound 443 blocked
• OAuth broken after certificate renewal — the auth certificate expired or was replaced without updating the auth configuration
• Free/busy works one way only — organization relationship disabled or misconfigured on one side
• Mail between environments quarantined or marked external — hybrid connectors bypassed because a third-party gateway sits in the TLS path
• Hybrid features stop after a CU falls behind — hybrid requires the current or immediately previous CU
• Hybrid Agent free/busy and migrations fail because the single registered server is offline
• Attribute edits blocked after decommissioning — the last server was uninstalled instead of shut down