How To Set Up A Hybrid Exchange Office 365 Environment

Anurag Lakhera -

Microsoft Exchange is the email and calendaring backbone for organizations of every size. Many still run an on-premises Exchange Server, but the risk and overhead of managing that hardware keeps pushing teams toward the cloud with Exchange Online in Microsoft 365 (Office 365).

A hybrid Exchange deployment sits between the two. It connects your on-premises Exchange organization with Exchange Online so users share one address book, one domain, and seamless mail flow — letting you migrate at your own pace or keep some mailboxes on-premises indefinitely.

This guide explains what a hybrid Exchange environment is, why you would use one, and how to set up a hybrid Exchange Office 365 environment in 2026 using Microsoft Entra Connect, the Hybrid Configuration Wizard, and remote-move mailbox migration.

Quick answer. A hybrid Exchange environment links your on-premises Exchange Server with Exchange Online (Office 365) so both share one address list, domain, and mail flow. You set it up by syncing accounts with Microsoft Entra Connect, running the Hybrid Configuration Wizard, then moving mailboxes to the cloud with remote-move migration.

What is a hybrid Exchange environment?

A hybrid Exchange environment is a deployment that joins an on-premises Exchange organization and Exchange Online into what looks and behaves like a single Exchange organization. Microsoft’s cloud authentication acts as the trust broker between the two sides, so identities, mail routing, and directory data stay consistent across on-premises and cloud.

In a working hybrid deployment you get:

  • A shared domain namespace — on-premises, migrated, and cloud-only users all send from the same email domain (for example, everyone stays @yourcompany.com).
  • A unified global address list (GAL) — on-premises and cloud users see each other in the same address book.
  • Free/Busy calendar sharing and MailTips across the on-premises and cloud sides.
  • Secure mail flow between Exchange Server and Exchange Online, treated as internal.
  • Online mailbox moves — mailboxes migrate to the cloud with almost no user disruption, and can be moved back if needed.

Hybrid also works as an on-ramp: it is the standard first step when you plan to eventually move an entire on-premises Exchange organization to Microsoft 365.

Why set up a hybrid Exchange deployment? (benefits)

Hybrid is the recommended path whenever you want the reach of the cloud without an abrupt, all-at-once cutover. The main benefits:

  • Migrate at your own pace. Move mailboxes in batches — a few pilot users first, then departments — instead of a single high-risk weekend cutover.
  • Native, low-disruption moves. Remote-move migration keeps Outlook profiles, delegates, and permissions intact, so users barely notice the switch.
  • Keep sensitive data on-premises. You can hold specific mailboxes or archives on your own hardware for compliance or data-residency reasons while everyone else runs in the cloud.
  • One seamless experience. Shared GAL, Free/Busy, and a single domain mean end users don’t have to think about where a mailbox lives.
  • A reversible on-ramp. If a migrated mailbox needs to come back, hybrid supports moving it on-premises again.

Hybrid Exchange vs. a full Office 365 migration

These solve different problems. Choosing correctly saves weeks of rework.

  • Hybrid Exchange keeps on-premises Exchange and Exchange Online running together long-term (or during a phased migration). Best when you have hundreds or thousands of mailboxes, strict compliance needs, or want a gradual, reversible move. It requires directory sync, the Hybrid Configuration Wizard, and at least one running on-premises Exchange server.
  • A full (direct) Office 365 migration — cutover or a third-party move — sends every mailbox to the cloud in one project, then decommissions Exchange on-premises. Best for smaller organizations that want to leave on-premises Exchange behind entirely and don’t need coexistence.

If you plan to fully retire Exchange on-premises but have a large or complex estate, most teams still start with hybrid, migrate in batches, then decommission — because it’s the lowest-risk route to the cloud.

What you need before you start (2026 prerequisites)

The hybrid landscape changed meaningfully in 2025–2026. Confirm the following before you begin:

  • A supported on-premises Exchange version. Exchange Server 2016 and 2019 reached end of support on October 14, 2025. New hybrid deployments should run Exchange Server Subscription Edition (SE), the current on-premises release. You can still run hybrid on Exchange 2019 during an active migration, but it’s no longer receiving updates.
  • A Microsoft 365 / Office 365 tenant with a verified custom domain and enough Exchange Online licenses for the mailboxes you plan to move.
  • Microsoft Entra Connect. Azure Active Directory is now Microsoft Entra ID, and the sync tool is Microsoft Entra Connect (formerly Azure AD Connect). It replicates your on-premises Active Directory objects to the cloud.
  • A dedicated Exchange hybrid app. Microsoft now requires a dedicated Microsoft Entra application for Exchange hybrid instead of the old shared first-party app. The Hybrid Configuration Wizard creates it for you; if you configured hybrid before this change, deploy the dedicated app to keep rich coexistence working.
  • Administrator credentials — an on-premises Exchange/AD admin account and a Microsoft 365 Global Administrator account.

How do you set up a hybrid Exchange Office 365 environment?

At a high level, there are three phases: synchronize your directory, run the Hybrid Configuration Wizard to establish coexistence, then move mailboxes to Exchange Online. Each phase is covered below.

Step 1: Sync accounts with Microsoft Entra Connect

First decide how users will authenticate. The common choices are:

  • Password hash synchronization — accounts and a hash of the password sync to Entra ID; simplest and Microsoft’s recommended default for most organizations.
  • Pass-through authentication — accounts sync, but the password is validated against on-premises AD in real time.
  • Federation — authentication is handled entirely on-premises (via AD FS or a third party); more complex, used for specific compliance requirements.

To synchronize your directory:

  • Run the Microsoft IdFix tool against your on-premises Active Directory first. It flags objects and attributes (duplicate proxy addresses, invalid characters) that would otherwise break directory sync — fix these before you sync.
  • Download and install Microsoft Entra Connect on a server in your environment. Choose Express settings for a standard password-hash-sync setup, or Customize if you need pass-through auth or federation.
  • Enter your Microsoft 365 (Entra ID) Global Administrator credentials, then your on-premises AD credentials when prompted.
  • Enable the Exchange hybrid deployment option and let synchronization run.

Once sync completes, sign in to the Microsoft 365 admin center and confirm your on-premises users now appear in the cloud directory.

Step 2: Run the Hybrid Configuration Wizard

The Hybrid Configuration Wizard (HCW) does the heavy lifting — it configures secure mail flow, the organization relationship for Free/Busy, and the connectors between the two sides.

  • In the on-premises Exchange admin center, open hybrid and choose enable / configure, then sign in to your Office 365 tenant as Global Administrator.
  • Download and launch the Hybrid Configuration Wizard when prompted.
  • The wizard auto-detects your on-premises Exchange organization. Sign in with both your on-premises and Office 365 Global Administrator credentials so it can read both sides.
  • Choose your hybrid type — Full Hybrid for complete coexistence (shared Free/Busy, MailTips, and secure mail flow), or Minimal Hybrid for a lighter setup aimed at a quicker cutover.
  • Select the topology — Modern Hybrid or Classic Hybrid. Modern Hybrid uses the Azure Hybrid Agent to create a secure, outbound-only connection, so you don’t have to open inbound firewall ports or publish Exchange to the internet. Microsoft recommends Modern Hybrid for nearly all new deployments; choose Classic only if you have a specific reason (such as an existing Edge Transport topology).
  • Let the wizard install, register, and validate the Hybrid Agent, enter the required FQDN details, and click update on the final screen.

When the HCW finishes, it creates the hybrid configuration object in your on-premises Active Directory and enables coexistence for your organization. (Note: the wizard’s exact screens are periodically refreshed by Microsoft, and older sign-in dialogs that said “Azure AD” now read “Microsoft Entra.” The flow is the same.)

Step 3: Move mailboxes to Exchange Online

With coexistence in place, assign each user an Exchange Online license, then move mailboxes using remote-move migration — the native hybrid method for Exchange 2013 and later (including 2016, 2019, and SE).

  • In the Exchange admin center, go to recipients > migration, click +, and choose Migrate to Exchange Online.
  • Select Remote move migration, then add the mailboxes you want to move.
  • Choose the migration endpoint, confirm the FQDN, name the batch, select Move primary mailbox, and finish.

To check progress, connect to Exchange Online with PowerShell and query the move requests:

Connect-ExchangeOnline
Get-MoveRequest -Identity "user@yourcompany.com"
Get-MoveRequestStatistics -Identity "user@yourcompany.com"

When a batch completes, the mailbox type in recipients > mailboxes switches to Office 365. Repeat for each batch until every mailbox you intend to migrate lives in the cloud. For orphaned data that isn’t in a live mailbox, you can also export to PST and use the Microsoft 365 network upload import method, or a reputable third-party EDB-to-Office 365 migration tool for bulk moves — but for standard mailboxes, remote-move migration through the hybrid connection is the cleanest option.

What is the Hybrid Configuration Wizard?

The Hybrid Configuration Wizard (HCW) is Microsoft’s tool that automates the entire coexistence setup. It gathers your on-premises Exchange and Active Directory topology, reads your Exchange Online configuration, then runs a long sequence of tasks on both sides to build secure mail connectors, the organization relationship, and the hybrid configuration object.

The HCW supports two topologies:

  • Modern Hybrid (Minimal and Full) — uses the Azure Hybrid Agent for an outbound-only connection. No inbound firewall changes, no need to publish Exchange to the internet. This is the default recommendation for new deployments.
  • Classic Hybrid (Minimal, Express, and Full) — the traditional model that requires publishing Exchange endpoints and opening inbound ports. Still valid, but usually chosen only for specific legacy or Edge Transport scenarios.

Important 2025–2026 changes to Exchange hybrid

Two Microsoft changes affect anyone running or building a hybrid deployment right now:

  • Dedicated Exchange hybrid app (2025). Microsoft retired the shared first-party app that hybrid used to authenticate to the cloud. You now need a dedicated Microsoft Entra application for Exchange hybrid. New HCW runs create it automatically; existing hybrid orgs should deploy the dedicated app to avoid breakage.
  • Graph API permission switch (Q2–Oct 2026). Rich-coexistence features are moving to a granular Microsoft Graph permission model. Organizations that need Free/Busy sharing, MailTips, and profile-picture sharing must install the required Exchange SE update and switch the dedicated hybrid app to Graph permissions before October 2026, or those features will stop working.

If you administer an older hybrid setup, treat both items as maintenance tasks to complete on a deadline — not optional.

After migration: housekeeping

A hybrid Exchange Office 365 environment gives you flexibility either way — a permanent split between cloud and on-premises, or a staging ground for a full move to the cloud. If you do plan to move entirely to Office 365, remember one commonly overlooked step: once migration is complete, stop publishing on-premises Exchange to the internet and follow Microsoft’s guidance before decommissioning your last Exchange server (an Exchange server is still required on-premises to manage mail-enabled objects while directory sync is active).

Hybrid Exchange migrations touch identity, mail flow, and firewall configuration at once, so they reward careful planning. If your team is short on Exchange or Microsoft 365 expertise, Codersera can help you hire vetted remote developers and infrastructure engineers to plan and execute the migration with less risk.

FAQ

What is a hybrid Exchange environment?

It is a deployment that connects your on-premises Exchange Server with Exchange Online (Office 365) so they behave as one organization — sharing a single domain, global address list, calendar Free/Busy, and secure mail flow. It lets you run both together or migrate mailboxes to the cloud gradually.

Do I still need Azure AD Connect for hybrid Exchange?

Yes, but it’s now called Microsoft Entra Connect. Azure Active Directory was renamed Microsoft Entra ID, and the directory-sync tool (formerly Azure AD Connect) is Microsoft Entra Connect. It replicates your on-premises Active Directory to the cloud so identities and the global address list stay unified.

What’s the difference between Modern Hybrid and Classic Hybrid?

Modern Hybrid uses the Azure Hybrid Agent to make a secure, outbound-only connection, so you don’t open inbound firewall ports or publish Exchange to the internet. Classic Hybrid uses the traditional published-endpoint model. Microsoft recommends Modern Hybrid for almost all new deployments.

Which Exchange Server version do I need for a hybrid deployment in 2026?

Exchange Server 2016 and 2019 reached end of support on October 14, 2025. New hybrid deployments should use Exchange Server Subscription Edition (SE), the current on-premises release. Exchange 2019 can still run hybrid during an active migration, but it no longer receives updates.

How do I move mailboxes in a hybrid Exchange setup?

Assign each user an Exchange Online license, then use remote-move migration from the Exchange admin center (recipients > migration). Remote move is the native hybrid method for Exchange 2013 and later and keeps Outlook profiles and permissions intact with minimal user disruption.

Is hybrid Exchange the same as fully migrating to Office 365?

No. Hybrid keeps on-premises Exchange and Exchange Online running together, either long-term or as a phased on-ramp to the cloud. A full migration moves every mailbox to the cloud in one project and decommissions on-premises Exchange. Large or compliance-heavy organizations usually start hybrid, then decommission later.