Update Your Exchange SE Hybrid On-premises Rich Coexistence to Graph

We already had the dedicated Exchange Hybrid app working with EWS, so I only ran "ConfigureExchangeHybridApplication.ps1 -CreateApplication -UseGraphApiOnly" to add the MS-Graph permissions and grant admin consent. In the Entra-ID Admin Center I can see, that it was successfull. Our Exchange On-Premises Server are up to date, so I also created the SettingOverride EnableRouteThroughMSGraphFeature and made a refresh with Get-ExchangeDiagnosticInfo to enable the use of MS-Graph. For testing purpose, I used an On-Premises user with OWA to check the free/busy times of an Exchange Online user. That still works. In the sign-in logs (Service principal sign-ins) of the dedicated Exchange hybrid app there are only "Office 365 Exchange Online" entries as Resource but none with MS-Graph. For me it seems, that MS-Graph is not used, although I have configured it. I have no errors. What have I missed?

In most cases, free/busy functionality works after switching to Graph.

The only scenario where it fails is when a shared mailbox has been added (via a security group) and the user opening that mailbox has their own mailbox in Exchange Online.
In other cases—where the shared mailbox is accessed by a user with an on-premises mailbox—it works.
It even works when the user opening the shared mailbox has no mailbox at all.

In OWA and Developer tools i became this error.

"ResponseMessage": { "MessageText": "Error during proxy web request. , inner exception: System.Net.WebException: The remote server returned an error: (403) Forbidden.\u000d\u000a   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)\u000d\u000a   at Microsoft.Exchange.InfoWorker.Common.Availability.Proxy.RestService.EndFindFreeBusyStatus(IAsyncResult asyncResult)\u000d\u000a   at Microsoft.Exchange.InfoWorker.Common.Availability.FreeBusyApplication.EndGraphWebRequest(GraphWebRequest proxyWebRequest, QueryList queryList, RestService service, IAsyncResult asyncResult)\u000d\u000a   at Microsoft.Exchange.InfoWorker.Common.Availability.GraphWebRequest.EndInvoke(IAsyncResult asyncResult)\u000d\u000a   at Microsoft.Exchange.InfoWorker.Common.Availability.AsyncWebRequest.EndInvokeWithErrorHandling()", "ResponseCode": "ErrorProxyRequestProcessingFailed", "MessageXml": "<?xml version=\"1.0\"?>\u000d\u000a<XmlNodeArray xmlns:t=\"http:\/\/schemas.microsoft.com\/exchange\/services\/2006\/types\" xmlns:m=\"http:\/\/schemas.microsoft.com\/exchange\/services\/2006\/messages\" xmlns=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\">\u000d\u000a  <ExceptionType xmlns=\"http:\/\/schemas.microsoft.com\/exchange\/services\/2006\/errors\">GraphWebRequestProcessingException<\/ExceptionType>\u000d\u000a  <ExceptionCode xmlns=\"http:\/\/schemas.microsoft.com\/exchange\/services\/2006\/errors\">5016<\/ExceptionCode>\u000d\u000a <ExceptionServerName xmlns=\"http:\/\/schemas.microsoft.com\/exchange\/services\/2006\/errors\">xxxxx<\/ExceptionServerName>\u000d\u000a <ExceptionMessage xmlns=\"http:\/\/schemas.microsoft.com\/exchange\/services\/2006\/errors\">Proxy web request error. , inner exception: The remote server returned an error: (403) Forbidden. LID: 43532<\/ExceptionMessage>\u000d\u000a<\/XmlNodeArray>",  "ResponseClass": "Error"  }

when i disable the override, it will works in any cases,,

Get-SettingOverride -Identity "EnableRouteThroughMSGraphFeature" | Set-SettingOverride -Parameters "Enabled=false"  -Confirm:$false

We have legacy Exchange 2016 servers in the environment without any mailboxes and no users are connected to them. Soon to be decommissioned. Do we need to wait until we decommission legacy servers or we can run the script to use Graph API in hybrid workflow right now?

I've run through all the steps in the article and removed EWS permissions and now Free/Busy between Exchange On-Premises and Exchange Online is no longer working under a certain scenario.

Working

• An Exchange On-Premises user logs in to an Exchange On-Premises mailbox - Can view Free/Busy of Exchange Online mailboxes
• An Exchange Online user logs in to an Exchange Online mailbox - Can view Free/Busy of Exchange On-Premises mailboxes

Not Working

• An Exchange Online user logs in to an Exchange On-Premises mailbox - Cannot view Free/Busy of Exchange Online mailboxes\

Update 7th September 2026: Microsoft have confirmed this is a known issue. Thank you Flare​ for pointing this out.

https://support.microsoft.com/en-us/servicing/exchange/server/update/2026/5127092

Also here (https://learn.microsoft.com/en-us/Exchange/hybrid-deployment/deploy-dedicated-hybrid-app#supported-scenarios) I'm not sure what "Partial (Automatic Replies only)" means for MailTips in the Supported by Graph API column. MailTips and Automatic Replies are 2 different things. Do MailTips work in Graph API currently?

How can we verify after running the script to switch from EWS to Graph API that the hybrid connection is actually using Graph API to connect instead of EWS - other than removing the EWS permissions via the script and testing to verify cross-premise functionality still works?

BTW here (https://learn.microsoft.com/en-us/Exchange/hybrid-deployment/deploy-dedicated-hybrid-app#enable-graph-api-based-hybrid-flow) there is a section for verifying the configuration using Test-OAuthConnectivity but that script is using EWS as the Service parameter and Graph does not seem to be a valid value for the Service parameter. When I run this script currently, it shows Success but appID not found. We have had the dedicated hybrid app in place for over a year and the cross-premise functionality works. We have not switched to Graph API yet. So not sure why it shows appID not found though the functionality works. Any ideas on that?

Shortly after implementing the new Graph API, our on‑premises users started complaining that cloud mailbox calendars were displayed two hours earlier in Outlook (classic). Appointments were shifted by –2 hours compared to our local time zone. Appointments scheduled during the winter period were shifted by –1 hour.

This led me to conclude that Outlook (classic) was no longer honoring daylight saving time rules, and that the appointments were being interpreted as UTC. OWA did not have this issue; appointments were displayed correctly there.

It took me some time to identify the cause, but after deleting the override EnableRouteThroughMSGraphFeature in our Exchange environment, Outlook (classic) started displaying appointments correctly again.

The regional settings on both the on‑premises and cloud mailboxes are configured for the same time zone. The regional settings on our Exchange servers are also configured identically.

Is this a known issue, or do I need to configure a specific regional or time zone setting elsewhere?

The_Exchange_Team​  

I don't see anything here about Feature Flighting. It should be mentioned that the Flighting might bring the setting override to the configuration, which could lead to duplicates.

I have the same question. What does it mean "rerun the script" 
The App is allready created. is it enough to rerun the script with updatecertificate...  ?? our auth certificate will expire soon.. ;)

What does "if you ran the script in the past, you need to re-run it again after installing the new update to activate new functionality" exactly mean?
Have I to ".\ConfigureExchangeHybridApplication.ps1 -DeleteApplication"?