As a part of Microsoft's Secure Future Initiative (SFI), security remains our top priority. In alignment with SFI, Exchange Server is implementing several changes to enhance the security of Exchange Server hybrid deployments. This blog post outlines the current and upcoming changes that apply specifically to Exchange Server hybrid deployments. If your organization does not have any form of Exchange hybrid configured, this post does not apply to you.
Change 1: Transitioning to a dedicated Exchange hybrid application
To enable Exchange hybrid deployment features such as calendar Free/Busy, MailTips, and user profile picture sharing (we call this “rich coexistence”), Exchange Server currently uses a shared service principal with the same application as Exchange Online. The name of this application is Office 365 Exchange Online, and it has the application ID 00000002-0000-0ff1-ce00-000000000000. This configuration is put in place by initial run of Hybrid Configuration Wizard (HCW) and is used to authenticate and secure the communication between Exchange Server and Exchange Online.
Beginning with the April 2025 HU release, Exchange Server is starting the transition to using a dedicated Exchange hybrid application in your tenant’s Entra ID. By October 2025, all current and new Exchange Server hybrid deployments that require rich coexistence features must move to using the dedicated Exchange hybrid app, as Exchange Online service will no longer allow the use of shared service principals beyond that date.
There are changes that administrators will need to make to enable and use the dedicated Exchange hybrid app. Please refer to the documentation for more information.
Change 2: Deprecation of EWS calls and switch to REST-based Microsoft Graph API calls for Exchange hybrid
The retirement of Exchange Web Services (EWS) in Exchange Online is coming. To maintain Exchange hybrid features, Exchange Server will (later this year) start supporting Microsoft Graph API as a replacement for EWS calls from Exchange Server to Exchange Online. This feature will release through an update for Exchange Server 2019 and Exchange Server 2016 in Q3 2025. In line with the transition to Microsoft Graph, the API permissions of the dedicated Exchange hybrid application will be revised to utilize more granular Graph API permissions. A blog post and documentation containing additional information will be published once that release is available.
Important: Microsoft Graph for Exchange Server hybrid requires the dedicated Exchange hybrid app (see Change 1 above) and will not use the current shared service principal approach. This change doesn’t affect the EWS API availability in Exchange Server (on-premises) and will only replace EWS calls from Exchange Server to Exchange Online with REST-based Microsoft Graph API calls.
Who needs to take action, and when?
|
If your organization uses the following Exchange hybrid functionality… |
The action you should take is… |
|
Customers who require rich coexistence between users with on-premises mailboxes and users who have Exchange Online mailboxes (specific features: Free/Busy lookups, MailTips and profile picture sharing). |
You MUST take the steps outlined in the documentation and switch to using the dedicated hybrid app (before October 2025) and then switch your hybrid to using Graph API (when available but before October 2026), or else rich coexistence features will break. After all servers are updated and are using the dedicated app, run “Service Principal Clean-Up Mode”. |
|
Customers using any other hybrid features only (migrations, SMTP relay, recipient management etc.) – but no rich coexistence required |
To help harden your hybrid configuration, we recommend that you use the provided script, to remove the organization certificate from the shared “Office 365 Exchange Online” application. See “Service Principal Clean-Up Mode” in the documentation. You do not need to create the dedicated hybrid app if you don’t need rich coexistence features. |
Exchange Hybrid customers who require rich coexistence must act
Step 1 – Switching your Exchange hybrid from using the shared service principal to using the dedicated Exchange hybrid app, before October 2025. This change can be done in two different ways:
- Option 1 (recommended): configure the dedicated Exchange hybrid app by installing April 2025 HU (or later) and running the ConfigureExchangeHybridApplication.ps1 script to switch Exchange hybrid from current “shared principal” configuration to using the dedicated Exchange hybrid app. Please see documentation.
- Option 2: we released an updated version of the Hybrid Configuration Wizard (HCW). Re-run HCW to configure the dedicated Exchange hybrid app. Please note that the script (Option 1) remains a more robust solution for working with the new hybrid app.
Step 2 – Changing Exchange hybrid to use Graph API calls and updating dedicated app permissions to a more granular Graph permission model, before October 2026:
- In Q3 2025, when Graph API update for Exchange Server is made available, all customers who require rich coexistence (even those who already performed the above Step 1) will need to install an Exchange 2016/2019 update and switch the dedicated Exchange hybrid app permissions to a more granular Graph API permission model. This must be done before October 2026. Documentation will be provided at release.
The following illustration shows what will be needed for organizations that use rich hybrid coexistence and when, related to Changes 1 and 2 mentioned above:
Exchange hybrid customers who require rich coexistence with Exchange Online must act between April 2025 HU release and October 2025. Unless you follow the steps to update to dedicated Exchange hybrid app (before October 2025) and then update it to Graph permission model (before October 2026), some Exchange hybrid functionality will break (Free/Busy sharing between on-premises and Exchange Online users, MailTips, profile picture sharing).
We strongly recommend that other Exchange hybrid customers do the following
Even if rich coexistence features are not in use, if the organization ever ran and completed the Exchange Hybrid Configuration Wizard (HCW) or followed the steps outlined in the Configure OAuth authentication between Exchange and Exchange Online organizations documentation – the organization certificate was uploaded to the shared service principal as a part of the HCW run.
To help harden your hybrid configuration, we strongly recommend that you use the provided script, to remove the organization certificate from the shared “Office 365 Exchange Online” application. See “Service Principal Clean-Up Mode” in the documentation.
You do not need to create the dedicated hybrid app if you don’t need rich coexistence features. Running of the script does not depend on a specific version of Exchange to be installed on-premises (you can run the script independently from installing Exchange Server updates on premises).
An overview of the process
We created the following flowchart that should help you visualize the steps that are needed to switch to the dedicated Exchange hybrid app:
Notes for steps marked on the flowchart:
- Configure OAuth authentication between Exchange and Exchange Online organizations.
- ‘Rich coexistence’ enables Free/Busy lookups, MailTips, and user profile picture sharing between Exchange on-premises and Exchange Online mailboxes.
- Setting the setting override as a separate step needs to be done only if the dedicated hybrid app was created using HCW or you used the script in the Split Execution Configuration mode.
Frequently Asked Questions
The Frequently Asked Questions (FAQ) on this subject have now been moved to feature documentation.
Major changes to this blog post:
- 8/11/2025: Added a flowchart with the overview of the process
- 8/7/2025: Added direct links to the ConfigureExchangeHybridApplication.ps1 script in the blog post
- 8/6/2025: Hybrid Configuration Wizard (HCW) is now updated to support creation of dedicated Exchange hybrid app; relevant updates done
- 8/4/2025: We moved the FAQ on the subject to feature documentation
- 7/31/2025: Clarified the recommendation for customers who do not use "rich coexistence" features
- 5/16/2025: Added a FAQ about multi-forest on-premises configuration
- 4/24/2025: Added a FAQ about renaming of the dedicated hybrid app
- 4/22/2025: Added a FAQ about no requirement to install April HU to clean up security principal only using the script
The Exchange Team
