hello,
I have a question if Microsoft meanwhile changed here something regarding proxy requests from on-premise to online and the delegation tokens as this article is from 2016? Below I tested this with two hybrid organizations where both mailboxes are in Exchange Online but the primary smtp addresses used for the requests both points in autodiscover to the on-premise organization and it works without using the remote routing address (targetAddress) in addition.
.....................
Never mind, found the reason, this works because in the organization relationship from Exchange Online is configured besides the native *.mail.onmicrosoft.com domain also the primary smtp domain and the Autodiscover endpoint is set in the organization relationship explicit to Exchange Online https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc/WSSecurity.
So all mailboxes hosted in Exchange Online will use for requesting free/busy information for this primary smtp address the autodiscover url which is set for the relationship and not the public dns records set for.
In case some mailboxes also hosted in on-premise with the primary smtp address and you wanted also request them from Exchange Online you have to use the mentioned different namespaces.
regards,
Marcus