Exchange Hybrid Wizard Setup, Follow Up Setup

Susan Dodds 421 Reputation points
2026-09-14T22:32:52.39+00:00

Exchange 2019 Cu14. Working on migrating to Exchange online.

The goal is to enable Entra connect, migrate Exchange to the cloud, end Entra connect, and manage the cloud/local AD separately.

When running the Exchange Hybrid Wizard, what all is configured on the Exchange 2019 server and Exchange Online?

I'm guessing I want to choose the whole hybrid setup in the wizard?

What will still need to be configured after the Wizard runs?

Will I need to install the Exchange Online powershell on my Exchange server? Do I need to setup the MRS endpoint manually or does the hybrid wizard do that?

Will migrating to the cloud be the same as migrating between Exchange servers on premise?

Regarding DNS, my email domain is contoso.org. Would the DNS be:

contoso-org.mail.protection.outlook.com

Can the server of authority property be moved back and forth or is it one way only?

What all needs to be done to enable the users as cloud managed?

Thanks

Exchange | Hybrid management
Exchange | Hybrid management

The administration of a hybrid deployment that connects on-premises Exchange Server with Exchange Online, enabling seamless integration and centralized control.

0 comments

3 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-14T22:33:21.47+00:00

    For an Exchange 2019 to Exchange Online migration, the Hybrid Configuration Wizard configures the core hybrid pieces on both sides.

    What HCW configures

    1. On-premises Exchange
    • OAuth authentication or a federation trust with Microsoft Entra ID, depending on what already exists.
    • Organization relationships used for hybrid features such as free/busy, Outlook on the web redirection, and MailTips.
    • Send and Receive connectors for hybrid mail flow.
    • The secure mail certificate used for TLS mail flow between on-premises Exchange and Exchange Online.
    • The coexistence domain as an accepted domain on-premises, typically <domain>.mail.onmicrosoft.com.
    • Email address policy updates for that coexistence domain when that option is selected.
    1. Exchange Online / Microsoft 365
    • Inbound and outbound connectors for hybrid mail flow.
    • Organization relationship settings for hybrid features.
    • A dedicated Exchange hybrid application in Microsoft Entra ID in supported builds.
    • A migration endpoint, if that option is selected in HCW.

    What hybrid features are enabled by default

    • Free/busy sharing
    • MailTips
    • Online archiving
    • Outlook on the web redirection
    • Exchange ActiveSync redirection
    • Secure mail over TLS

    Whether to choose full hybrid

    • If the plan is to migrate mailboxes from on-premises Exchange 2019 to Exchange Online, a full hybrid configuration is the appropriate choice.
    • Minimal Hybrid is recommended in the context only for cloud mailbox management scenarios where the goal is to manage cloud mailboxes from on-premises Exchange without complex coexistence.

    What still needs to be configured after HCW

    • Microsoft Entra synchronization: hybrid requires cloud sync or connect sync on a separate on-premises server.
    • Mailbox migration batches and execution.
    • DNS for inbound internet mail, if mail flow changes are required. HCW does not control inbound internet mail; the domain MX record in DNS does.
    • Any post-deployment changes to hybrid options can be done later with HCW or Exchange Management Shell.

    About Exchange Online PowerShell The provided context does not state that Exchange Online PowerShell must be installed on the Exchange server.

    About the MRS endpoint HCW can create the migration endpoint if that option is selected. The documented cmdlet is: New-MigrationEndpoint or Set-MigrationEndpoint [-Name 'Hybrid Migration Endpoint - EWS (Default Web Site)'] [-ExchangeRemoteMove $true] [-RemoteServer <OnPremisesEntryPointDomain>]

    So manual creation is not required when HCW is configured to create the migration endpoint.

    About the migration method The context supports that mailbox moves from on-premises Exchange to Exchange Online use a migration endpoint created for remote move migration. It does not describe this as being the same process as moving mailboxes between on-premises Exchange servers, so only the supported fact is that hybrid mailbox migration uses the migration endpoint and remote move migration path.

    About DNS naming For hybrid, the coexistence domain added by HCW is documented as <domain>.mail.onmicrosoft.com.

    So for contoso.org, the coexistence domain format is: contoso.mail.onmicrosoft.com

    Also, inbound internet mail is controlled by the MX record in DNS, not by HCW.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Jay1 Tran 860 Reputation points Independent Advisor
    2026-09-14T23:01:09.1466667+00:00

    Hi Susan,

    Thank you for reaching out.

    Based on your description, I recommend a full hybrid configuration if users will remain in both environments during migration. Minimal hybrid may be sufficient if all mailboxes will move within a few weeks and you do not need extended coexistence. Avoid centralized mail transport unless cloud email must route through the on-premises server.

    Please note that Exchange Server 2019 is now out of support. Before publishing Exchange services for migration, I recommend updating the server to the latest available Exchange 2019 cumulative and security updates, or moving to Exchange Server Subscription Edition if the migration will not be completed promptly.

    The Hybrid Configuration Wizard normally configures:

    • Secure mail-flow connectors and TLS
    • Free/busy and organization relationships
    • OAuth and tenant-routing settings
    • MRS Proxy migration functionality
    • The Exchange Online remote-move migration endpoint

    You should not need to create the MRS endpoint manually, but verify it after HCW completes. Exchange Online PowerShell is not required on the Exchange server. I recommend installing it on an administrative workstation instead.

    Mailbox migration is similar to an on-premises mailbox move, but Exchange Online performs it as a remote migration batch through MRS Proxy over HTTPS. Outlook profiles generally remain intact.

    After HCW, you will still need to:

    • Configure and validate Entra Connect
    • License users and migrate all mailbox types
    • Reconfigure SMTP relay devices and applications
    • Update MX, Autodiscover, SPF, DKIM, and DMARC
    • Validate cloud authentication before disabling synchronization
    • Remove hybrid and decommission Exchange using Microsoft’s supported process

    For contoso.org, the MX value will normally be: contoso-org.mail.protection.outlook.com. Please use the exact value shown in the Microsoft 365 admin center rather than constructing it manually.

    I hope the information I shared earlier was somewhat helpful in addressing your issue. If you have any further questions or updates, please don’t hesitate to share. I’m always happy to assist further if needed.   

    Was this answer helpful?

  3. Jay1 Tran 860 Reputation points Independent Advisor
    2026-09-15T19:14:28.9966667+00:00

    Hi Susan,

    Thank you for your response.

    This is broadly correct, but a few points require clarification.

    The Hybrid Configuration Wizard creates the principal hybrid connectors and relationships, but mail flow should still be tested in both directions. Common issues include certificate selection, firewall access, DNS, connector settings, and SMTP relay dependencies. The HTTPS certificate must cover the published EWS/MRS Proxy name, while the hybrid SMTP connectors must reference the correct trusted certificate.

    Before disabling Entra Connect, verify the authentication method:

    • With Password Hash Synchronization, users can continue authenticating directly through Entra ID using the last synchronized password. Future password changes will be managed separately in the cloud.
    • With Pass-Through Authentication or AD FS, first transition and test users with managed cloud authentication, normally PHS, before removing the on-premises authentication components. PTA does not automatically fall back to PHS during an outage.

    For a permanent tenant-wide transition, Microsoft recommends first uninstalling the synchronization client and then disabling directory synchronization through Microsoft Graph or Microsoft Entra PowerShell. Existing synchronized users and groups become cloud-managed rather than being deleted and recreated. The operation can take up to 72 hours and cannot be canceled once started.

    Do not test this process by excluding production users from synchronization scope. Taking an individual synchronized user out of scope normally moves the cloud object into the deleted-users container. Although this is a soft deletion rather than an automatic hard deletion, it can still cause service interruption and should not be used as the tenant conversion method.

    Mailbox data should remain intact during the supported tenant-wide conversion, but I would not describe the process as having guaranteed zero impact. Before proceeding, verify Exchange attributes, cloud authentication, licenses, groups, Teams dependencies, applications, devices, SMTP relay, and administrative processes. Some legacy on-premises attributes may also need cleanup after synchronization is disabled.

    For more information, please refer to:

    This link is shared by community members for your convenience. It points to a third-party site that is not managed or verified by Microsoft. I can’t guarantee the quality, safety, or suitability of any content or software found there. Please review carefully and make sure you understand any potential risks before using it. 

    I hope the information I shared earlier was somewhat answered your questions. Please keep me posted on any updates.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.