As a part of Microsoft's Secure Future Initiative (SFI), security remains our top priority. In alignment with SFI, Exchange Server is implementing several changes to enhance the security of Exchange ...
Updated Aug 11, 2025
Version 11.0
Blog Post
LukasSMSFT
Microsoft
MicrosoftDavidH38 it looks like you've tried running the script in all-in-one configuration mode on Windows Server Core. Can you confirm that? If so, running the script in this mode on Server Core doesn't work. Instead, you need to run in in split-execution mode (https://learn.microsoft.com/en-us/Exchange/hybrid-deployment/deploy-dedicated-hybrid-app#split-execution-configuration-mode).
The steps are as follows (the documentation explains them with more context and examples):
- Export the public key of the auth certificate
- Run the script on a Windows Client or Server with GUI to create the application and upload the certificate
- Run the script on Windows Server Core to enable the feature
Yes i'm running server core as MS Best practice, thats means your recomended way is wrong as most people would of deployed on core
- LukasSMSFT
We recommend running Exchange Server on Windows Server Core but most organizations are still running it on Windows Server with GUI for various reasons. The script does OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) to acquire a token for running the Graph API calls. This requires a component which doesn't exist on Windows Server Core (e.g., there is no web browser support on Server Core). That's the reason why the script can't be executed in all-in-one configuration mode. For this (and other) reason, we've added the split-execution mode.