Exchange Hybrid new domain

%3CLINGO-SUB%20id%3D%22lingo-sub-2147931%22%20slang%3D%22en-US%22%3EExchange%20Hybrid%20new%20domain%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2147931%22%20slang%3D%22en-US%22%3EHi%3CBR%20%2F%3E%3CBR%20%2F%3EWe%20have%20a%20requirement%20to%20add%20a%20new%20domain%20name%20and%20I%E2%80%99m%20unsure%20if%20I%20need%20to%20add%20the%20domain%20name%20to%20the%20SAN%20certificate%3F%3CBR%20%2F%3E%3CBR%20%2F%3EOur%20setup%3A%3CBR%20%2F%3EExchange%202016%20cu17%20hybrid%3CBR%20%2F%3ECentral%20mail%20routing%20is%20enabled%20(MX%20and%20autodiscover%20is%20pointing%20to%20on-prem)%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2147931%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ehybrid%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2148125%22%20slang%3D%22en-US%22%3ERe%3A%20Exchange%20Hybrid%20new%20domain%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2148125%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F971634%22%20target%3D%22_blank%22%3E%40Psshutdown%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3EYou%20probably%20should%2C%20if%20there%20might%20be%20a%20need%20to%20configure%20TLS%20with%20partner.%3CBR%20%2F%3EWhat%20is%20the%20domain%20will%20be%20used%20for%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2148812%22%20slang%3D%22en-US%22%3ERe%3A%20Exchange%20Hybrid%20new%20domain%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2148812%22%20slang%3D%22en-US%22%3EThe%20domain%20will%20be%20used%20as%20a%20primary%20emails%20for%20some%20users.%3CBR%20%2F%3E%3CBR%20%2F%3E1.%20I%20understand%20the%20domain%20needs%20to%20be%20verified%2C%3CBR%20%2F%3E2.%20Run%20the%20hybrid%20wizard%20and%20select%20the%20new%20domain%3CBR%20%2F%3E3.%20Add%20this%20to%20on-prem%20exchange%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2150482%22%20slang%3D%22en-US%22%3ERe%3A%20Exchange%20Hybrid%20new%20domain%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2150482%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F971634%22%20target%3D%22_blank%22%3E%40Psshutdown%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3EYes%2C%20that%20is%26nbsp%3B%20the%20must%2C%20here%20are%20the%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Fadd-custom-domain%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Erequirements%3C%2FA%3E.%3CBR%20%2F%3EIf%20you%20changing%20the%20name%20space%3A%3C%2FP%3E%3CP%3EAdd%20mail.newdomain.com%20and%20autodiscover.domain.com%20to%20UCC%20SAN%20certificate%20containing%20other%20domains.%3C%2FP%3E%3CP%3EPotentially%20re-do%20virtual%20directories.%3CBR%20%2F%3ENew%20DNS%20zone%20SPF%26nbsp%3BMX%20%2C%20Autodiscover%2C%20records%20for%20the%20new%20domain.%3CBR%20%2F%3EAdd%20custom%20domain%20in%20Azure%2C%20verify.%3C%2FP%3E%3CP%3EAdd%20domain%20under%20Accepted%20Domains%20in%20on-prem%20Exchange.%3CBR%20%2F%3EAdd%20email%20address%20policy%20in%20on-prem%20Exchange.%20(should%20be%20lastest%20or%20n-1%20CU%20version)%3C%2FP%3E%3CP%3EApply%20email%20address%20policy%20to%20users%3C%2FP%3E%3CP%3EValidate%20AADConnect%20replication%20status%3CBR%20%2F%3EValidate%20mail%20flow.%3C%2FP%3E%3CP%3EChange%20user%20UPNs%20to%20new%20domain%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor
Hi

We have a requirement to add a new domain name and I’m unsure if I need to add the domain name to the SAN certificate?

Our setup:
Exchange 2016 cu17 hybrid
Central mail routing is enabled (MX and autodiscover is pointing to on-prem)
3 Replies

@Psshutdown 
You probably should, if there might be a need to configure TLS with partner.
What is the domain will be used for?

The domain will be used as a primary emails for some users.

1. I understand the domain needs to be verified,
2. Run the hybrid wizard and select the new domain
3. Add this to on-prem exchange

@Psshutdown 
Yes, that is  the must, here are the requirements.
If you changing the name space:

Add mail.newdomain.com and autodiscover.domain.com to UCC SAN certificate containing other domains.

Potentially re-do virtual directories.
New DNS zone SPF MX , Autodiscover, records for the new domain.
Add custom domain in Azure, verify.

Add domain under Accepted Domains in on-prem Exchange.
Add email address policy in on-prem Exchange. (should be lastest or n-1 CU version)

Apply email address policy to users

Validate AADConnect replication status
Validate mail flow.

Change user UPNs to new domain?