About a year ago, we announced Exchange Server Security Changes for Hybrid Deployments. This change impacted Exchange hybrid customers who host some of their mailboxes on-premises and their on-premis...
Updated Aug 31, 2026
Version 6.0
Blog Post
We already had the dedicated Exchange Hybrid app working with EWS, so I only ran "ConfigureExchangeHybridApplication.ps1 -CreateApplication -UseGraphApiOnly" to add the MS-Graph permissions and grant admin consent. In the Entra-ID Admin Center I can see, that it was successfull. Our Exchange On-Premises Server are up to date, so I also created the SettingOverride EnableRouteThroughMSGraphFeature and made a refresh with Get-ExchangeDiagnosticInfo to enable the use of MS-Graph. For testing purpose, I used an On-Premises user with OWA to check the free/busy times of an Exchange Online user. That still works. In the sign-in logs (Service principal sign-ins) of the dedicated Exchange hybrid app there are only "Office 365 Exchange Online" entries as Resource but none with MS-Graph. For me it seems, that MS-Graph is not used, although I have configured it. I have no errors. What have I missed?
UseGraphApiOnly only configures the permissions on the azure application. There are more configurations in Exchange required to get Graph to work - "...
enable the Graph API-based hybrid flow via a Setting Override..." IMO review the script ConfigureExchangeHybridApplication.ps1 as there are more parameters specific to that. If you omit them and only use UseGraphApiOnly they do not get set.
Now it's working. The missing piece was the GraphBaseUrl for the Auth-Server EvoTS.