Exchange 2016 Hybrid OAuth to Exchange Online EWS failing with 403 after HCW rerun

One important point is missing here: in 2026 I would first verify whether the Dedicated Exchange Hybrid App is actually configured and enabled.

Since October 31, 2025, Exchange Online permanently blocks hybrid EWS calls that use the old shared service principal. Your Exchange 2016 CU23 build 15.1.2507.061 is new enough to support the dedicated app.

A successful HCW run does not necessarily mean the dedicated app is active. If HCW was used to create it, verify that the ExchangeOnpremAsThirdPartyAppId setting override was also enabled.

Get-SettingOverride | Where-Object {$.ComponentName -eq "Global" -and $.SectionName -eq "ExchangeOnpremAsThirdPartyAppId"}

If the dedicated app was created through HCW but the feature was not enabled, follow the Microsoft procedure to enable the override before spending more time rebuilding PartnerApplication or the old shared OAuth trust.

Also treat the MRSProxy Access Denied separately. Microsoft states that the Dedicated Exchange Hybrid App change does not affect mailbox onboarding or offboarding migrations.

If the Auth Certificate was renewed or replaced, also verify that the current certificate is present on the dedicated hybrid application. I documented the HCW and dedicated-app certificate handling here: https://ceyhunkirmizitas.net/exchange-server-auth-certificate-renewal-recovery-timezone/

MS Ref: https://learn.microsoft.com/en-us/exchange/hybrid-deployment/deploy-dedicated-hybrid-app

Hi @Shawn Alston

Thank you for providing the detailed information and troubleshooting steps you have already completed.

Since the OAuth token is generated successfully but Exchange Online returns HTTP 403 Forbidden, the issue is likely occurring during the validation of the OAuth trust relationship rather than during token creation. Before rebuilding any hybrid components, I recommend validating the existing OAuth configuration.

1.Verify the Exchange Auth Certificate

On the Exchange 2016 server, confirm the active OAuth certificate:

Get-AuthConfig | Format-List
Get-ExchangeCertificate | Format-List Thumbprint,Subject,NotAfter,HasPrivateKey

Confirm that:

• CurrentCertificateThumbprint matches the OAuth certificate thumbprint.
• The certificate is not expired.
• The certificate has a private key.

If the OAuth certificate was recently renewed, rotated, or replaced, verify that the published certificate information matches the current AuthConfig settings before considering republishing.

2.Validate the PartnerApplication and AuthServer objects

Check that the Exchange Online trust objects are enabled and contain the expected metadata:

Get-PartnerApplication | Format-List Name,Enabled,ApplicationIdentifier
Get-AuthServer | Format-Table Name,Enabled,Type,AuthMetadataUrl

3.Verify the Exchange Online side of the hybrid trust

From Exchange Online PowerShell, validate the hybrid relationship objects:

Get-IntraOrganizationConnector | Format-List *
Get-OrganizationRelationship | Format-List *

Confirm that the objects are enabled and still reflect the current hybrid configuration.

4.Perform additional OAuth validation and review HCW logs

If possible, perform additional OAuth validation and review the Hybrid Configuration Wizard logs for OAuth-related warnings or errors. This can help determine whether the issue is isolated to a specific trust path or affects the hybrid OAuth relationship more broadly.

5.Validate EWS/MRSProxy configuration separately

Since the migration endpoint is now reaching MRSProxy but returning Access Denied, validate the EWS virtual directory configuration:

Get-WebServicesVirtualDirectory | Format-List Identity,ExternalUrl,OAuthAuthentication,WindowsAuthentication

and confirm that MRSProxy is enabled:

Get-WebServicesVirtualDirectory | Format-List Identity,MRSProxyEnabled

6.If mailbox migrations continue to fail with Access Denied, enable additional OAuth logging for MRS:

New-SettingOverride -Name "MRS OAuthLogging Settings" 
-Component "Mrs" 
-Section "MRSProxyAuthLogging" 
-Parameters ("Enabled=true") 
-Reason "Enable MRS OAuth Logging"

Restart the Microsoft Exchange Mailbox Replication service after applying the override:

Restart-Service MSExchangeMailboxReplication

 I hope this helps.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".       

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.