Forum Discussion

Mali_Stane's avatar
Mali_Stane
Copper Contributor
Aug 11, 2025
Solved

Exchange hybrid removal – partial

I have full hybrid configured.

I have no mailboxes on prem.

I use Exchange as mail relay (auth and non auth SMTP).  With on extra information.  One of SMTP domains is configured as  internal relay.  So, emails address to unknown recipients is routed to exchange  on premise, that I use Target address SMTP:*.mail.onmicrosoft.com  on  existing object to rout email to valid O365 mailbox.

I was looking in to this article : https://jaapwesselius.com/2020/12/15/remove-exchange-hybrid-configuration/#:~:text=Disable%20OAuth%20on%2Dpremises,on%2Dpremises%20and%20Exchange%20Online.&text=These%20are%20the%20steps%20needed,option%20in%20Azure%20AD%20Connect.

 

Remove certificates :

I will run command .\ConfigureExchangeHybridApplication.ps1 -ResetFirstPartyServicePrincipalKeyCredentials

This will brake  Free/Busy, MailTips, and Photos.

Disable Oath:

On Prem and in Cloud.

Get-intraOrganizationConnector | Set-IntraOrganizationConnector -Enabled $False

 

SMTP Routing

I will not run Remove-HybridConfiguration, i dont see mail issue if setting is left in AD. And i don’t need to recreate connectors.

Should I run Remove-IntraOrganizationConnector  on premise that include domain domain.mail.onmicrosoft.com which i use for routing, and same on O365, which include all registered domains.  I believe I can.  Should I left  both connector intact in on prem and in O365.

I have created Dedicated send connector :

AddressSpaces : {smtp:*;1}

SmartHosts : {********.mail.protection.outlook.com}

CloudServicesMailEnabled : True

Fqdn, TlsCertificateName, RequireTLS … True

I also have the following connector : Outbound to Office 365 - ******-********-*******

TlsDomain : mail.protection.outlook.com

AddressSpaces : {smtp:********.mail.onmicrosoft.com;1}

 

The default receive connector is configured to accept mail from O365. The firewall allows only mail originating from Exchange Online IP addresses. Existing receive and send connector configurations established by the hybrid setup will be maintained.

 

Remove-OrganizationRelationship :

I already run this command on premise and  O365.

 

SCP and AutoDiscover :

Public CNAM record all points  to O365 autodiscover.outlook.com

Internal entries remain, and I have many domains to update. If I run the commands now, will they immediately disrupt on-premises Autodiscover, or continue working as usual? Can I gradually set up CNAME records and finally set AutoDiscoverServiceInternalUri to $null?

  • First, run the Hybrid Configuration Wizard and select Complete Uninstall, then manually clean up the residual objects CN=Hybrid Configuration in ADSI.

2 Replies

  • Mali_Stane's avatar
    Mali_Stane
    Copper Contributor

    Yes i believe that would be the fastest method.  And then recreate connectors. 

  • PartiarTitle's avatar
    PartiarTitle
    Brass Contributor

    First, run the Hybrid Configuration Wizard and select Complete Uninstall, then manually clean up the residual objects CN=Hybrid Configuration in ADSI.

Resources