EWS Autodiscover Process in Hybrid with "internal" Exchange Servers

Hi everyone,

i really need help about the EWS Autodiscover process in a specific hybrid Environment.  

Customer is starting to use Exchange Online. For Full Hybrid configuration there is a seperate new Exchange SE with a valid certificate, NAT for IP Ranges from M365 and public available URLs for Autodiscover,EWS,...

There are internal Exchange Servers which are used only for internal access. Those are the servers with all mailboxes. All URLs are configured for internal use (mail.contoso.internal)

Migration is working, access to own calender is working, mailfllow is working. But there are problems to access other users calender. If a user which is migrated to Exchange Online (or via Teams) try to access another calender which is onPrem, there is no access. So i tried to use connectivity analyzer for teams integration to find out whats the problem. 

Result: Autodiscover resolves, connects to Hybrid and gets EWS URL as answer. But it gets the internal EWS URL from the internal Exchange Servers, not from the public available URLs which are configured at the hybrid server. I visualised the two scenarios.

Number1: Thats how i thought it would work

1. Autodiscover to autodiscover.contoso.com
2. Hybrid answers with EWS URL: hybrid.contoso.com
3. Connect from EXO to hybrid EWS URL
4. Proxy to Internal Exchange

Number2 : Thats what really happens

1. Autodiscover to autodiscover.contoso.com
2. Hybrid relays request to internal Exchange (Mailbox Server)
3. Server answers with internal EWS URL: mail.contoso.internal
4. Connect from EXO to internal EWS URL (which is obviously not working)

So as you can see, the autodiscover process asks the internal Exchange for its EWS URLs and not as i expected the hybrid server's URLs. I always thought, the hybrid server works as a sort of proxy for every external connection from EXO. But it seems that the hybrid just relays the autodiscover  request to the server which holds the mailbox. And this servers in this scenario cannot change their EWS URLs to a public resolvable FQDN. 

So my question is: Is this correct? Does the process always works like this or did i do anything wrong in the configuration? I hope you understand my explanation.

Thanks in advance!!!