Exchange online hybrid setup

Question

Exchange online hybrid setup

Susan Dodds 376

Exchange 2019 Cu14.

I've seen demos running the hybrid configuration wizard but I still have some unanswered questions.

What is the main difference between the minimum and full hybrid options in the wizard?

Once the wizard completes, what all is needed to be configured in Exchange 2019, Exchange Online, DNS, etc. to get it working?

The goal is to get hybrid working, move everyone to the cloud, and shut down the Exchange 2019 server.

What all would be involved to make that happen?

Thanks

2 answers

Your answer

Answer 1

Hani-Ng 7,000 Microsoft External Staff Moderator

Hi Susan Dodds

Thank you for posting your question in the Microsoft Q&A forum.

Based on your current environment (Exchange 2019 CU14) and your goal to fully migrate and decommission the on‑premises server, I’d like to add a few more pieces of information in addition to the response from Q&A Assist, in the hope that they’ll be helpful to you.

Minimal Hybrid and Full Hybrid: The main difference is the level of integration during the coexistence period.

Minimal Hybrid: Best for rapid migrations (days or weeks). It configures mail flow and migration endpoints but does not support cross-premises Free/Busy (calendar availability) sharing. Use Minimal Hybrid to quickly migrate Exchange mailboxes to Microsoft 365 or Office 365 | Microsoft Learn
Full Hybrid: Recommended for most scenarios. It ensures a smooth user experience by allowing on-premises and cloud users to view each other's calendar availability and manage permissions. Exchange Server hybrid deployments | Microsoft Learn

Prerequisites & Configuration

The Hybrid Configuration Wizard (HCW) automates the connectors and OAuth trusts, but you must ensure the following are in place for the wizard to succeed:

Certificates: A valid third-party public certificate installed on Exchange.
Firewall: Port 443 (HTTPS) open inbound for migration, and Port 25 (SMTP) open inbound/outbound for mail flow.

Hybrid Configuration wizard | Microsoft Learn

Migration and DNS Cutover

Once the HCW completes, you will proceed with moving the data:

Migrate: Create migration batches in the Exchange Admin Center to move mailboxes to Exchange Online.
DNS: Once all mailboxes are moved, update your public DNS records (MX, Autodiscover, SPF) to point directly to Microsoft 365.

Manage migration batches in Exchange Online | Microsoft Learn

Decommissioning Exchange 2019 (Crucial Step): Since you are using Exchange 2019 CU14, you can shut down the server without breaking user management, provided you follow the "Management Tools" method:

Do not uninstall Exchange from the Control Panel, as this removes necessary user attributes from Active Directory.
Install Exchange Management Tools on a domain-joined workstation. This allows you to manage email attributes (aliases, new users) after the server is offline.
Once the tools are verified, you may shut down the Exchange Server VM.

Manage recipients in Exchange Hybrid environments using Management tools | Microsoft Learn

How and when to decommission your on-premises Exchange servers in a hybrid deployment | Microsoft Learn

I hope the above insights help you.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hani-Ng 7,000 Reputation points Microsoft External Staff Moderator

2025-12-24T05:55:08.56+00:00

Hi Susan Dodds

I just wanted to quickly check in to see if you need any additional information. Please feel free to let me know!
Susan Dodds 376 Reputation points

2025-12-24T19:38:42.9333333+00:00

Thanks for the reply.

After the migration, I am not going to keep Entra sync active so the cloud and local will be configured separately so I will probably not need the management tools?

At the moment, I have proven to 365 I own the domain but nothing else yet.

What connector and DNS settings will be needed?

To confirm, all I need to do is run the wizard, set up a connector, update DNS, migrate, and decommission? Do I need to migrate the built in mailboxes?
Hani-Ng 7,000 Reputation points Microsoft External Staff Moderator

2025-12-25T04:57:59.98+00:00
Hi Susan Dodds

Thank you for the clarification. If you plan to stop using Entra Connect (Directory Sync) after the migration, you are moving to a cloud only identity model.

Based on this new information, I would like to share some information according to your concerns below:

Do you need the Management Tools? No.

If you disable Directory Sync after the migration, Microsoft 365 becomes the source of authority. You will manage passwords, aliases, and new users directly in the Microsoft 365 Admin Portal. You will no longer need the on-premises Exchange tools.

Connectors and DNS Settings

Connectors: You do not need to set these up manually. The Hybrid Configuration Wizard (HCW) will automatically create the Inbound and Outbound connectors required for the migration to work.

DNS:

Now (Pre-migration): Keep MX and Autodiscover pointing to On-Premises.

Later (Post-migration): Change MX to yourdomain-com.mail.protection.outlook.com and Autodiscover to autodiscover.outlook.com.

Do you migrate built-in mailboxes? No.

You only need to migrate user mailboxes, shared mailboxes, and resource (room/equipment) mailboxes.

Do not migrate the "Administrator" mailbox (unless it is a real person's email).

Do not migrate system mailboxes (DiscoverySearch, arbitration, etc.). Exchange Online has its own system mailboxes already.

The Revised Workflow:

There is one critical additional required to make the users editable in the cloud.

Run HCW: Sets up the trust and connectors automatically.

Migrate: Move all user data to the cloud.

DNS Cutover: Point MX and Autodiscover to Office 365.

Disable Sync: Run the PowerShell command
Set-MsolDirSyncEnabled -EnableDirSync $false
For detailed information, you can see: https://github.com/Azure/azure-docs-powershell-azuread/blob/main/azureadps-1.0/MSOnline/Set-MsolDirSyncEnabled.md

Note: It may take up to 72 hours for the users to convert from Synced to Cloud-Only. Once they convert, you can manage them in the cloud.

Decommission: Once users are editable in the cloud, you can safely uninstall Exchange 2019 and shut down the server

For detailed information, you can refer to: Turn off directory synchronization for Microsoft 365 - Microsoft 365 Enterprise | Microsoft Learn

I hope this information is helpful.
Hani-Ng 7,000 Reputation points Microsoft External Staff Moderator

2025-12-26T02:40:37.6233333+00:00

Hi Susan Dodds

I wanted to follow up and ensure the information provided was useful to you. If you have any new updates or further inquiries, please let me know. Thank you!
Susan Dodds 376 Reputation points

2025-12-26T12:12:50.14+00:00

Thanks for the reply.

Will desktop Outlook profiles and phone email profiles automatically sense the changes or would they need to be reconfigured?

Thanks
Hani-Ng 7,000 Reputation points Microsoft External Staff Moderator

2025-12-29T03:04:15.0833333+00:00

Hi Susan Dodds

Thank you for your response.Regarding your question about client reconfiguration, based on my research. the experience differs slightly between desktop and mobile environments.

Outlook Desktop Experience

For users on Windows or Mac, the transition is designed to be automatic. Because you are moving existing mailboxes via the Hybrid method, the Autodiscover service will automatically redirect the application to the new location in the cloud.

Users will simply receive a pop-up notification stating that "The administrator has made a change that requires you to restart Outlook." Once you restart the application and enter your Microsoft 365 password, Outlook will connect to the cloud using the existing profile. This ensures that their local data cache (.OST file) is preserved, and you will not need to re-download your email history.

You can reference this behavior in this article below:

Outlook continually prompts for password when you try to connect to Microsoft 365 - Outlook | Microsoft Learn

Mobile Device Experience

Mobile behavior depends largely on the specific application being used. The Microsoft Outlook App (iOS/Android) is cloud-aware and generally handles the transition gracefully by simply requesting the new password.

However, native mail applications often cache the old server settings aggressively. While they may attempt to redirect, it is often faster and more reliable to advise these users to remove the account from their phone settings and add it back again to ensure mail flow resumes immediately.

I hope this information helps.
Susan Dodds 376 Reputation points

2025-12-30T01:53:54.87+00:00
Thanks for the reply and sorry for so many follow up questions.

To confirm, the new OWA website for 365 is just outlook.com?

To test that everything is working, will I be able to change the MX and autodiscover records and disconnect/shut down my local email server to test everything is working properly before decommissioning the local server?

contoso.com.mail.protection.outlook.com autodiscover.outlook.com
Hani-Ng 7,000 Reputation points Microsoft External Staff Moderator

2025-12-30T05:54:07.73+00:00
Hi Susan Dodds

Thank you for your response. Here is some information that I hope will help.

OWA website: The direct URL for business access is outlook.office.com.

Testing by "Disconnecting" the Server

Based on information from my side, this is highly recommended. Temporarily shutting down the Exchange Server VM for a monitoring period (e.g., 5–7 days) allows you to perform a validation phase. This ensures that no legacy applications, printers, or devices are silently attempting to relay mail through the local server.

If mail flow remains stable during this period, you can safely proceed to permanently decommission (uninstall/delete) the server.

DNS Records Validation

Your Autodiscover record is correct, but please double-check the syntax of your MX record. In various situations, Microsoft uses a hyphen (-) instead of a dot (.) between the domain name and the suffix.

Autodiscover (CNAME): autodiscover.outlook.com

MX Record:

You wrote: contoso.com.mail.protection.outlook.com

A various situation format is: contoso-com.mail.protection.outlook.com

You can verify this exact spelling by checking the Settings > Domains section in your Microsoft 365 Admin Center.

I hope this is helpful to you.
Susan Dodds 376 Reputation points

2025-12-30T07:14:56.4333333+00:00

Thank you for your reply. I am currently using a 3rd party DKIM authentication software installed on my server. Will anything need to be done regarding DKIM? Due to stability reasons, I would prefer to not uninstall that software. I might be able to turn it off, if needed, but would prefer to not touch it unless I have to. This software gave me a public DNS record that I'm using as well. 365 is not currently handling DKIM.
Hani-Ng 7,000 Reputation points Microsoft External Staff Moderator

2026-01-04T23:27:22.34+00:00

Hi Susan Dodds

Thank you for your response.

Based on my understanding about your description, you do not need to uninstall the 3rd party software if you are concerned about server stability. You can leave it exactly as it is, but you must set up DKIM inside Microsoft 365 to ensure your cloud emails are authenticated.

However, once you switch your mail flow to Microsoft 365, that software will no longer be able to sign your emails.

Since the local software cannot sign cloud emails, you must configure Microsoft 365 to handle DKIM for you. This is a built-in feature and does not require extra software. You do not need to uninstall or touch the software on the server. Just let it sit there until you decommission the server.

Create New DNS Records: Microsoft 365 requires you to publish 2 CNAME records in your DNS - that mean Microsoft 365 is allowed to sign email for this domain.

Enable DKIM in the Portal: Once the CNAME records are live, you go to the Microsoft 365 Defender portal and toggle the "Enable" switch for your domain.

How to use DKIM for email in your custom domain

You can ignore the local software (do not uninstall it if you fear instability), but you must set up DKIM inside Microsoft 365 to ensure your cloud emails are authenticated.I hope this helps.
Susan Dodds 376 Reputation points

2026-01-05T18:24:34.3233333+00:00

Thank you for your reply.

Does that mean I would need to have both MS DKIM and my DKIM active at the same time when mailboxes are being migrated to prevent disruption of emails?

Regarding testing, would I be able to turn MS DKIM on/off as needed to test mailflow before migrating everyone to 365?

Thanks
Hani-Ng 7,000 Reputation points Microsoft External Staff Moderator

2026-01-06T05:55:49.1066667+00:00

Hi Susan Dodds

Regarding the active state of your DKIM configurations, you should absolutely have both the Microsoft DKIM and your on-premises third-party DKIM active simultaneously during the migration. This will not cause any conflict. Your local software uses one specific selector, while Microsoft 365 uses a completely different one. This allows you to publish the Microsoft DNS records immediately without affecting or breaking the signing process for the users who are still on your local server.

As for testing, while you technically have the ability to toggle Microsoft DKIM on and off, I strongly advise against disabling it for testing purposes. DKIM does not control the flow of mail; it only validates the sender's identity to prevent spam flagging. If you migrate a user to the cloud without Microsoft DKIM enabled, their outgoing emails will lack your custom domain signature, significantly increasing the chance of their messages landing in the recipient's Junk folder. Therefore, the best practice is to configure and enable Microsoft DKIM now so that every migrated user is fully authenticated from their very first email.
Hani-Ng 7,000 Reputation points Microsoft External Staff Moderator

2026-01-07T04:20:33.11+00:00

Hi Susan Dodds

Just following up to see if the information was useful. Let me know if you have any updates or questions. Thank you.

Answer 2

The main difference between the minimal hybrid and full hybrid options in the Hybrid Configuration Wizard lies in their intended use cases and the features they enable:

Minimal Hybrid Configuration: This option is designed for organizations that plan to migrate their mailboxes to Exchange Online quickly, typically over a few weeks or less. It is suitable for those who do not intend to continue running directory synchronization to manage users. This configuration allows for a simpler setup and is often referred to as express migration.
Full Hybrid Configuration: This option is more comprehensive and allows for a more seamless coexistence between on-premises Exchange and Exchange Online. It supports a broader range of features, including cross-premises availability, cross-premises archive, and more complex scenarios where you might need ongoing management of both environments.

Once the Hybrid Configuration Wizard completes, several configurations are needed:

Exchange 2019: You will need to ensure that your on-premises Exchange server is properly configured to support hybrid features, including setting up connectors, configuring mail flow, and ensuring that the necessary permissions are in place.
Exchange Online: You will need to configure settings in Exchange Online to support hybrid features, such as enabling secure mail and configuring organization relationships.
DNS: You will need to update your DNS records to ensure that mail flow is directed correctly between your on-premises and cloud environments. This includes configuring MX records and any necessary Autodiscover records.

To successfully move everyone to the cloud and shut down the Exchange 2019 server, you will need to:

Migrate all user mailboxes to Exchange Online.
Ensure that all hybrid features are functioning correctly, including free/busy sharing and MailTips.
Decommission the on-premises Exchange server, ensuring that any necessary data is retained and that users are fully transitioned to Exchange Online.
Update any remaining configurations in DNS and ensure that all users can access their mailboxes without issues.

Planning and executing these steps carefully will help you achieve a successful transition to a full cloud implementation.

References:

Share via

Exchange online hybrid setup

2 answers

Your answer