Multiple forest exhange hybrid without forest trust

Occasional Contributor



i have to make sure the requirement,

I have two forest and want to deploy Exchange hybrid with single tenant. based on this article,


there is no requirement to configure forest trust to deploy Exchange hybrid


is it correct we can do without trust ?

how azure AD Connect recognize the other domain without trust ?




5 Replies
AD connect can use a service account, it doesn't need to be in the domain. You'll essentially be setting up two forest connectors and one AAD connector.

Supported topology is at this link:

Hi, @SeanMcAvinue 


happy to hear there is no trust required :smile:


if I already make azure ad connect and other forest dc ping each other, is there any other requirement like conditional dns forwarder ? because not all the resource/ip address is routable each domain. I just need to run sync user only.


Thanks for your reply

As long as the AD Connect server can resolve both forests and can connect on the required ports as per the documentation AD Connect can sync your users. You can add OU filtering to the connectors to capture just the users you want. You can set up DNS conditional forwarders to ensure AD Connect can resolve both forests and all DCs.

The topology you're looking for is in the documentation as "Multiple forests, single Azure AD tenant"



I already test with conditional forwarders, but conditional forwarders is not suitable with my environment.


lets give me example, i have two forest. and


If i enable conditional forwarder in contoso DNS, all record to will route trough dns A record.  if contoso client try to ping, it will resolve by internal ip, and the routing is not availble, the result is ping is RTO. My requirement is when contoso client ping, it will resolve by ip public


i curious, is it any solution that suit to my requirement ? is it hostfile available to do that ?


Thanks before




best response confirmed by Ichwan (Occasional Contributor)


Host file records should work but generally not recommended as they introduce complexity and manual configuration. Alternatively you could look at a dedicated non-AD integrated DNS server to manage just the AD Connect lookups, or update your public records in your internal DNS servers to point to public IP (This depends on if that will impact your internal users..