Exchange Hybrid Wizard Setup, Follow Up Setup

Hi Susan,

Thank you for your response.

This is broadly correct, but a few points require clarification.

The Hybrid Configuration Wizard creates the principal hybrid connectors and relationships, but mail flow should still be tested in both directions. Common issues include certificate selection, firewall access, DNS, connector settings, and SMTP relay dependencies. The HTTPS certificate must cover the published EWS/MRS Proxy name, while the hybrid SMTP connectors must reference the correct trusted certificate.

Before disabling Entra Connect, verify the authentication method:

• With Password Hash Synchronization, users can continue authenticating directly through Entra ID using the last synchronized password. Future password changes will be managed separately in the cloud.
• With Pass-Through Authentication or AD FS, first transition and test users with managed cloud authentication, normally PHS, before removing the on-premises authentication components. PTA does not automatically fall back to PHS during an outage.

For a permanent tenant-wide transition, Microsoft recommends first uninstalling the synchronization client and then disabling directory synchronization through Microsoft Graph or Microsoft Entra PowerShell. Existing synchronized users and groups become cloud-managed rather than being deleted and recreated. The operation can take up to 72 hours and cannot be canceled once started.

Do not test this process by excluding production users from synchronization scope. Taking an individual synchronized user out of scope normally moves the cloud object into the deleted-users container. Although this is a soft deletion rather than an automatic hard deletion, it can still cause service interruption and should not be used as the tenant conversion method.

Mailbox data should remain intact during the supported tenant-wide conversion, but I would not describe the process as having guaranteed zero impact. Before proceeding, verify Exchange attributes, cloud authentication, licenses, groups, Teams dependencies, applications, devices, SMTP relay, and administrative processes. Some legacy on-premises attributes may also need cleanup after synchronization is disabled.

For more information, please refer to:

• Turn off directory synchronization for Microsoft 365 - Microsoft 365 Enterprise | Microsoft Learn
• Exchange Hybrid Configuration Wizard Guide | Airbyte

This link is shared by community members for your convenience. It points to a third-party site that is not managed or verified by Microsoft. I can’t guarantee the quality, safety, or suitability of any content or software found there. Please review carefully and make sure you understand any potential risks before using it. 

I hope the information I shared earlier was somewhat answered your questions. Please keep me posted on any updates.

Hi Susan,

Thank you for reaching out.

Based on your description, I recommend a full hybrid configuration if users will remain in both environments during migration. Minimal hybrid may be sufficient if all mailboxes will move within a few weeks and you do not need extended coexistence. Avoid centralized mail transport unless cloud email must route through the on-premises server.

Please note that Exchange Server 2019 is now out of support. Before publishing Exchange services for migration, I recommend updating the server to the latest available Exchange 2019 cumulative and security updates, or moving to Exchange Server Subscription Edition if the migration will not be completed promptly.

The Hybrid Configuration Wizard normally configures:

• Secure mail-flow connectors and TLS
• Free/busy and organization relationships
• OAuth and tenant-routing settings
• MRS Proxy migration functionality
• The Exchange Online remote-move migration endpoint

You should not need to create the MRS endpoint manually, but verify it after HCW completes. Exchange Online PowerShell is not required on the Exchange server. I recommend installing it on an administrative workstation instead.

Mailbox migration is similar to an on-premises mailbox move, but Exchange Online performs it as a remote migration batch through MRS Proxy over HTTPS. Outlook profiles generally remain intact.

After HCW, you will still need to:

• Configure and validate Entra Connect
• License users and migrate all mailbox types
• Reconfigure SMTP relay devices and applications
• Update MX, Autodiscover, SPF, DKIM, and DMARC
• Validate cloud authentication before disabling synchronization
• Remove hybrid and decommission Exchange using Microsoft’s supported process

For contoso.org, the MX value will normally be: contoso-org.mail.protection.outlook.com. Please use the exact value shown in the Microsoft 365 admin center rather than constructing it manually.

I hope the information I shared earlier was somewhat helpful in addressing your issue. If you have any further questions or updates, please don’t hesitate to share. I’m always happy to assist further if needed.