Maintain Hybrid Exchange Beyond the Configuration Wizard

TL;DR

Hybrid works only when five layers stay aligned: Directory sync, OAuth/federation trust, DNS, firewalls, and EOP/connectors. A green wizard doesn’t validate your reality—preflight and continuous checks do.

---

The Hidden Interdependencies (at a glance)

• Directory → Cloud: Azure AD Connect must sync mail, proxyAddresses, legacyExchangeDN, msExchMailboxGuid—on time, every time.

• Trust: Federation + OAuth certificates and app registrations underpin free/busy, EWS, mailbox moves.

• DNS: Autodiscover, MX, SPF, DKIM, and (if used) SRV/CNAME must be correct internally and externally.

• Firewall/NAT/SSL: MRSProxy, EWS, OAB, Autodiscover, Federation endpoints need consistent publishing and inspection exceptions.

• EOP/Connectors: Inbound/outbound connectors, TLS, and SPF/DKIM/DMARC alignment govern delivery and reputation.

---

Copy-Paste Runbook

1) Preflight (before running HCW or any big cutover)

Directory & Attributes

# Spot-check critical attributes for a target user Get-ADUser upn@contoso.com -Properties mail,proxyAddresses,legacyExchangeDN,msExchMailboxGuid | Select-Object SamAccountName,mail,legacyExchangeDN, @{n='Proxy';e={$_.proxyAddresses -join ';'}}, @{n='GUIDPresent';e={([string]::IsNullOrEmpty($_.msExchMailboxGuid) -eq $false)}} # Confirm AAD Connect health & schedule Get-ADSyncScheduler Start-ADSyncSyncCycle -PolicyType Delta

Must be true:

• msExchMailboxGuid present (for migrated users)

• proxyAddresses has correct SMTP: primary + aliases

• legacyExchangeDN preserved for X.500 reply addresses

OAuth & Federation

# On-prem Exchange Management Shell Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox user@contoso.com -Verbose Get-FederationTrust | fl *Domain*,TokenIssuerUri,OrgCertificate Test-FederationTrust -Verbose Get-AuthConfig | fl CurrentCertificateThumbprint,ServiceName,IssuerIdentifier,Realm Get-ExchangeCertificate | ? {$_.Services -match 'SMTP|IIS'} | fl Thumbprint,NotAfter,Services,Subject

Must be true:

• Valid, non-expired certificates bound to IIS/SMTP and used by AuthConfig/Federation

• Test-OAuthConnectivity success

Autodiscover / DNS (internal & external)

# From internal resolver and an external resolver Resolve-DnsName autodiscover.contoso.com -Type CNAME,A Resolve-DnsName contoso.com -Type MX Resolve-DnsName contoso.com -Type TXT # check SPF/DMARC/DKIM selectors

Must be true:

• Autodiscover points where you intend (typically EXO once pilot starts)

• MX → EOP (or your smart host) consistently

• SPF includes all senders (EOP + any gateways): e.g., v=spf1 include:spf.protection.outlook.com include:yourgateway ~all

• DKIM selectors published (if enabled); DMARC policy aligns with reality

Firewall / Publishing

Publish (HTTPS/443) with real certs for:

• https://mail.contoso.com/ews/* (EWS)

• https://mail.contoso.com/mrsproxy.svc (MRSProxy)

• https://autodiscover.contoso.com/autodiscover/* (Autodiscover)

• https://mail.contoso.com/oab/* (OAB, if needed)

• Federation metadata if hosted locally

Hints

• Disable SSL offload that breaks client cert chains.

• Exempt EXO traffic from TLS inspection where possible.

• Ensure reverse proxy preserves headers and supports large POST (MRS).

EOP / Connectors

• Inbound connector: From your on-prem public IPs; TLS required.

• Outbound: To internet or smart host; TLS policies match.

• Accepted domains: Authoritative vs Internal Relay as designed.

---

2) Validation Tests (after HCW, before users)

Mailbox moves & EWS

Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer mail.contoso.com -Credentials (Get-Credential) -Authentication Basic -Autodiscover Test-WebServicesConnectivity -ClientAccessServer mail.contoso.com -TrustAnySSLCertificate:$false -MailboxCredential (Get-Credential)

Free/Busy (both directions)

• Cloud → On-prem: create meeting from EXO mailbox, check on-prem user’s availability.

• On-prem → Cloud: reverse test. If one-way only, recheck federation trust and OAuth.

Autodiscover & Outlook

• New profile creation (internal + external network)

• Outlook /SPA & Modern Auth prompts stay silent (no loops)

Message hygiene

• Send external mail; verify SPF=pass, DKIM=pass, DMARC policy alignment

• Trace via Message Trace in EXO and any on-prem gateways

---

3) DNS & Firewall Cheat Sheet

Function	Record / Path	Notes
Autodiscover	autodiscover.contoso.com → CNAME autodiscover.outlook.com (typical in EXO-first) or A to on-prem	Be consistent internal/external; avoid split-brain surprises
MX	contoso.com → *.mail.protection.outlook.com	If staging through gateway, reflect that in SPF too
SPF	TXT: v=spf1 include:spf.protection.outlook.com include:gateway.example.com ~all	Keep under 10 DNS lookups
DKIM	selector1._domainkey / selector2._domainkey TXT	Enable in EXO + publish selectors
DMARC	_dmarc.contoso.com TXT v=DMARC1; p=quarantine; rua=...	Start with p=none to observe

Firewall (public → on-prem CAS/MBX)

• TCP 443 to /autodiscover/*, /ews/*, /mrsproxy.svc, /oab/*

• Source: Microsoft 365 endpoints (or any if you cannot maintain lists)

• No TLS interception on these paths; pass SNI and full chains

---

4) Health Monitoring (make it boring)

Daily/Hourly

• Azure AD Connect: Get-ADSyncScheduler next run OK; portal health green

• Cert expirations: alert 30/15/7 days for IIS/SMTP/Auth/Federation certs

• Message trace anomalies: spikes in deferrals/bounces

• Synthetic EWS/OAuth tests (script below via scheduled task)

# Simple OAuth/EWS synthetic (example skeleton) $u = "probe@contoso.com" $result = Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox $u -ErrorAction SilentlyContinue if(-not $result -or $result.Result -ne "Success"){ Write-EventLog -LogName Application -Source "HybridProbe" -EntryType Error -EventId 8001 -Message "OAuth/EWS probe failed for $u" }

---

5) Common Break/Fix (symptoms → fastest checks)

Free/Busy fails one way

1. Test-FederationTrust and check federation cert NotAfter

2. Get-AuthConfig thumbprint matches a valid cert; rerun Set-AuthConfig -PublishCertificate if rotated

3. Firewall allowing /ews/* both ways; no TLS inspection

Mailbox moves hang (10–20%)

1. Test-MigrationServerAvailability to on-prem URL

2. MRSProxy enabled (Get-WebServicesVirtualDirectory | fl MRSProxyEnabled,ExternalUrl)

3. Reverse proxy headers/timeouts; check 443 deep inspection

4. AAD Connect caught up; attributes present

Outlook profile loops / prompts

1. Resolve-DnsName autodiscover.contoso.com (internal + external) resolve as intended

2. Modern Auth enforced? Check client version/registry and CA policies

3. Mixed Autodiscover targets between internal/external? Fix split-brain

Random NDRs / spam placement

1. SPF includes all senders; nslookup -type=txt contoso.com

2. DKIM enabled & selectors valid; DMARC aligned with From: domain

3. EOP connectors TLS alignment; check message trace disposition

---

6) Change & Lifecycle Guardrails

• Certificate calendar: Auth/Federation/IIS/SMTP certs with owners + renewal runbook

• Config drift checks: Quarterly export and diff of EXO connectors, accepted domains, transport rules

• DNS audits: Internal + external zones after any mail routing/project change

• AAD Connect: Service account, scheduler, and upgrade cadence documented; staging server tested

• Rollback notes: How to temporarily point Autodiscover/MX back; how to pause migration batches safely

---

One-Page Pre-GoLive Checklist

• mail, proxyAddresses, legacyExchangeDN, msExchMailboxGuid synced and verified for pilot users

• Test-OAuthConnectivity and Test-FederationTrust Success

• Autodiscover/MX/SPF/DKIM/DMARC correct (int/ext)

• MRSProxy & EWS published; firewall TLS inspection bypassed

• EOP connectors tested; TLS enforced as intended

• AAD Connect healthy; delta sync completes under expected SLA

• Certs >60 days remaining; monitoring in place

• Synthetic tests scheduled; helpdesk runbook ready

---

Closing Thought

The HCW wires endpoints; it doesn’t validate your data, trust, or path. Treat hybrid like a living system: verify attributes, renew trust, watch DNS, and keep paths clean—so your “invisible web” stays invisible to your users.

---

Want more playbooks like this?
Get full access to M365 Show – Microsoft 365 Digital Workplace Daily → m365.show/subscribe