SOLVED
Home

Azure AD Connect and "Exchange hybrid deployment" write-back

%3CLINGO-SUB%20id%3D%22lingo-sub-294190%22%20slang%3D%22en-US%22%3EAzure%20AD%20Connect%20and%20%22Exchange%20hybrid%20deployment%22%20write-back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294190%22%20slang%3D%22en-US%22%3E%3CP%3EAt%20a%20management%20level%2C%20one%20of%20the%20assumptions%20(correct%20or%20incorrect)%26nbsp%3Bwhen%20opting%20for%20Office%20365%20was%20that%20synchronization%20would%20be%20one-way%20(from%20our%20Active%20Directory%20to%20the%20Office%20365%2FAzure).%20Unless%20otherwise%20configured%2C%20there%20would%20be%20no%20way%20for%20possible%20changes%20in%20the%20Office%20365%20to%20be%20written%20back%20to%20local%20Active%20Directory.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBecause%20of%20this%2C%20when%20we%20first%20configured%20Azure%20AD%20Connect%2C%20we%20did%20not%20select%20the%20optional%20feature%20%22Exchange%20hybrid%20deployment%22%20even%20though%20we%20plan%20to%20run%20the%20Exchange%20hybrid%20configuration%20wizard%20later%20(and%20thus%20have%20an%20Exchange%20hybrid%20environment).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20selecting%20this%20optional%20feature...%20mandatory...%20for%20Exchange%20hybrid%20environments%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20was%20told%20that%20if%20the%20Exchange%20attributes%20that%20are%20synced%20back%20to%20local%20Active%20Directory%20are%20not%20required%20for%20our%20environment%2C%20the%20feature%20is%20optional.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20evaluating%20the%20need%20for%20these%20features%20and%20the%20related%20attributes%20synced%20to%20local%20Active%20Directory%20but%2C%20assuming%20we%20did%20not%20need%20them%2C%20what%20negative%20effect%20could%20that%20have%20on%20the%20general%20hybrid%20environment%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20example%2C%20Exchange%20attributes%20from%20local%20Active%20Directory%20to%20Azure%20AD%20%2F%20Exchange%20Online%20would%20be%20synced%20regardless%2C%20correct%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20in%20advance!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-294190%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-294657%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%20and%20%22Exchange%20hybrid%20deployment%22%20write-back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294657%22%20slang%3D%22en-US%22%3E%3CP%3EWhy%20the%20need%20not%20to%20writeback%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20the%20Office%20365%20product%20was%20evaluated%2C%20the%20assumption%20was%20made%20that%20nothing%20from%20the%20%22Cloud%22%20would%20make%20changes%20to%20our%20local%20environment%20(so%20we%20would%20be%26nbsp%3B%20%22safe%22%20).%20Features%20like%20password%20writeback%20to%20local%20AD%20were%20thought%20to%26nbsp%3B%20be%20strictly%20optional.%20This%20is%20what%20security%20and%20management%20understood%20at%20the%20time.%20I%20was%20asked%20to%20confirm%20that%20Exchange%20writeback%20is%20necessary%20for%20a%20hybrid%20environment%20(Yes%2C%20we%20do%20intend%20to%20run%20the%20HCW%20and%20setup%20a%20hybrid%20environment).%20Details%20on%20mailbox%20moves%20being%20written%20back%20to%20on-premises%20seems%20to%20be%20a%20compelling%20reason%20to%20enable%20this%20feature.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-294280%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%20and%20%22Exchange%20hybrid%20deployment%22%20write-back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294280%22%20slang%3D%22en-US%22%3EAhhh%2C%2010%2F4%20%3A)%3C%2Fimg%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-294278%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%20and%20%22Exchange%20hybrid%20deployment%22%20write-back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294278%22%20slang%3D%22en-US%22%3E%3CP%3EYep%2C%20I%20was%20responding%20to%20his%20comment%20%22%3CSPAN%3EIs%20selecting%20this%20optional%20feature...%20mandatory...%20for%20Exchange%20hybrid%20environments%3F%22%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-294275%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%20and%20%22Exchange%20hybrid%20deployment%22%20write-back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294275%22%20slang%3D%22en-US%22%3EThose%20Attributes%20write%20up%20to%20AzureAD%2F365%20because%20all%20your%20changes%20should%20happen%20onprem%20%3AP.%20But%20he's%20referring%20to%20not%20having%20any%20users%20in%20365%20yet.%20In%20that%20case%20I%20don't%20see%20a%20requirement.%20But%20as%20you%20start%20adding%20any%20kind%20of%20Office%20365%20groups%20or%20anything%20of%20that%20nature%20you%20are%20definatley%20going%20to%20want%20a%20hybrid%20setup.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-294272%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%20and%20%22Exchange%20hybrid%20deployment%22%20write-back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294272%22%20slang%3D%22en-US%22%3E%3CP%3EWhy%20the%20need%20not%20to%20writeback%3F%3C%2FP%3E%0A%3CP%3EIf%20you%20have%20mailboxes%20both%20and%20in%20365%2C%20you'll%20want%20that%20writeback%20enabled.%3C%2FP%3E%0A%3CP%3EFor%20example%20the%20legacyExchangeDN%20of%20a%20moved%20mailbox%20is%20written%20back%20as%20an%20X500%20address%20on-prem%20to%20the%20remote%20mailbox%20.%3C%2FP%3E%0A%3CP%3EIf%20you%20dont%20have%20that%2C%20its%20going%20to%20cause%20issues%20for%20your%20Outlook%20clients%20with%20cached%20values%20and%20public%20folders.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Freference-connect-sync-attributes-synchronized%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Freference-connect-sync-attributes-synchronized%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-294212%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%20and%20%22Exchange%20hybrid%20deployment%22%20write-back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294212%22%20slang%3D%22en-US%22%3EIt%20really%20depends%20on%20what%20you're%20planning%20on%20making%20use%20of%20in%20Office%20365.%20Some%20things%20will%20have%20more%20affect%20than%20others%20by%20not%20having%20exchange%20Online.%20Not%20setting%20hybrid%20isn't%20required%20initially%20unless%20you%20are%20going%20to%20host%20mailboxes%20in%20both%20locations%20at%20the%20same%20time.%20Nothing%20writes%20back%20via%20Azure%20AD%20unless%20you%20have%20premium%20P1%20and%20configure%20it%20too.%20The%20only%20thing%20that%20writes%20back%20in%20a%20hybrid%20setup%20is%20the%20migration%20jobs%2C%20they%20will%20talk%20back%20and%20tell%20your%20migration%20endpoint%20to%20basically%20inform%20your%20on-prem%20server%20that%20the%20mailbox%20was%20moved%20and%20mark%20it%20as%20in%20the%20cloud%2C%20but%20that's%20not%20AzureAD%20doing%20that%2C%20that's%20Exchange%20Services.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-711420%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%20and%20%22Exchange%20hybrid%20deployment%22%20write-back%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-711420%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F73034%22%20target%3D%22_blank%22%3E%40David%20Machula%3C%2FA%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F869%22%20target%3D%22_blank%22%3E%40Chris%20Webb%3C%2FA%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F86%22%20target%3D%22_blank%22%3E%40Andy%20David%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWanted%20to%20add%20that%20if%20you're%20in%20an%20AD%20greenfield%20with%20Exchange%20Online%20only%2C%20AzureAD%20Connect%20will%20not%20writeback%20the%20mail%20attribute%20to%20the%20user%20account.%26nbsp%3B%20The%20mail%20attribute%20would%20be%20quite%20necessary%20for%20many%20OnPrem%20applications%2Fservices.%3C%2FP%3E%3C%2FLINGO-BODY%3E
David Machula
Occasional Contributor

At a management level, one of the assumptions (correct or incorrect) when opting for Office 365 was that synchronization would be one-way (from our Active Directory to the Office 365/Azure). Unless otherwise configured, there would be no way for possible changes in the Office 365 to be written back to local Active Directory.

 

Because of this, when we first configured Azure AD Connect, we did not select the optional feature "Exchange hybrid deployment" even though we plan to run the Exchange hybrid configuration wizard later (and thus have an Exchange hybrid environment).

 

Is selecting this optional feature... mandatory... for Exchange hybrid environments?

 

I was told that if the Exchange attributes that are synced back to local Active Directory are not required for our environment, the feature is optional.

 

We are evaluating the need for these features and the related attributes synced to local Active Directory but, assuming we did not need them, what negative effect could that have on the general hybrid environment?

 

For example, Exchange attributes from local Active Directory to Azure AD / Exchange Online would be synced regardless, correct?

 

Thank you in advance!

7 Replies
It really depends on what you're planning on making use of in Office 365. Some things will have more affect than others by not having exchange Online. Not setting hybrid isn't required initially unless you are going to host mailboxes in both locations at the same time. Nothing writes back via Azure AD unless you have premium P1 and configure it too. The only thing that writes back in a hybrid setup is the migration jobs, they will talk back and tell your migration endpoint to basically inform your on-prem server that the mailbox was moved and mark it as in the cloud, but that's not AzureAD doing that, that's Exchange Services.

Solution

Why the need not to writeback?

If you have mailboxes both and in 365, you'll want that writeback enabled.

For example the legacyExchangeDN of a moved mailbox is written back as an X500 address on-prem to the remote mailbox .

If you dont have that, its going to cause issues for your Outlook clients with cached values and public folders. 

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-sync-attributes-syn...

 

 

Those Attributes write up to AzureAD/365 because all your changes should happen onprem :P. But he's referring to not having any users in 365 yet. In that case I don't see a requirement. But as you start adding any kind of Office 365 groups or anything of that nature you are definatley going to want a hybrid setup.

Yep, I was responding to his comment "Is selecting this optional feature... mandatory... for Exchange hybrid environments?"

 

 

Why the need not to writeback?

 

When the Office 365 product was evaluated, the assumption was made that nothing from the "Cloud" would make changes to our local environment (so we would be  "safe" ). Features like password writeback to local AD were thought to  be strictly optional. This is what security and management understood at the time. I was asked to confirm that Exchange writeback is necessary for a hybrid environment (Yes, we do intend to run the HCW and setup a hybrid environment). Details on mailbox moves being written back to on-premises seems to be a compelling reason to enable this feature.

@David Machula @Chris Webb @Andy David 

 

Wanted to add that if you're in an AD greenfield with Exchange Online only, AzureAD Connect will not writeback the mail attribute to the user account.  The mail attribute would be quite necessary for many OnPrem applications/services.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
50 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
32 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
15 Replies
Dev channel update to 80.0.355.1 is live
josh_bodner in Discussions on
67 Replies