![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 7.000000000000001%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESA%3C/text%3E%3C/svg%3E)
Exchange | Hybrid management
The administration of a hybrid deployment that connects on-premises Exchange Server with Exchange Online, enabling seamless integration and centralized control.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Thank you for providing the detailed information and troubleshooting steps you have already completed.
Since the OAuth token is generated successfully but Exchange Online returns HTTP 403 Forbidden, the issue is likely occurring during the validation of the OAuth trust relationship rather than during token creation. Before rebuilding any hybrid components, I recommend validating the existing OAuth configuration.
1.Verify the Exchange Auth Certificate
On the Exchange 2016 server, confirm the active OAuth certificate:
Get-AuthConfig | Format-List
Get-ExchangeCertificate | Format-List Thumbprint,Subject,NotAfter,HasPrivateKey
Confirm that:
-
CurrentCertificateThumbprintmatches the OAuth certificate thumbprint. - The certificate is not expired.
- The certificate has a private key.
If the OAuth certificate was recently renewed, rotated, or replaced, verify that the published certificate information matches the current AuthConfig settings before considering republishing.
2.Validate the PartnerApplication and AuthServer objects
Check that the Exchange Online trust objects are enabled and contain the expected metadata:
Get-PartnerApplication | Format-List Name,Enabled,ApplicationIdentifier
Get-AuthServer | Format-Table Name,Enabled,Type,AuthMetadataUrl
3.Verify the Exchange Online side of the hybrid trust
From Exchange Online PowerShell, validate the hybrid relationship objects:
Get-IntraOrganizationConnector | Format-List *
Get-OrganizationRelationship | Format-List *
Confirm that the objects are enabled and still reflect the current hybrid configuration.
4.Perform additional OAuth validation and review HCW logs
If possible, perform additional OAuth validation and review the Hybrid Configuration Wizard logs for OAuth-related warnings or errors. This can help determine whether the issue is isolated to a specific trust path or affects the hybrid OAuth relationship more broadly.
5.Validate EWS/MRSProxy configuration separately
Since the migration endpoint is now reaching MRSProxy but returning Access Denied, validate the EWS virtual directory configuration:
Get-WebServicesVirtualDirectory | Format-List Identity,ExternalUrl,OAuthAuthentication,WindowsAuthentication
and confirm that MRSProxy is enabled:
Get-WebServicesVirtualDirectory | Format-List Identity,MRSProxyEnabled
6.If mailbox migrations continue to fail with Access Denied, enable additional OAuth logging for MRS:
New-SettingOverride -Name "MRS OAuthLogging Settings"
-Component "Mrs"
-Section "MRSProxyAuthLogging"
-Parameters ("Enabled=true")
-Reason "Enable MRS OAuth Logging"
Restart the Microsoft Exchange Mailbox Replication service after applying the override:
Restart-Service MSExchangeMailboxReplication
I hope this helps.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.