Your existing on-premises Exchange 2010 server supports allowing your users to access their mailbox using Outlook Web App. Outlook Web App provides users with a browser-based e-mail experience that is similar to the experience when using the Outlook 2010 mail client.

To launch Outlook Web App from outside the corporate network, users typically type the externally accessible FQDN of the mailbox server followed by the Outlook Web App virtual directory name, such as https://mail.contoso.com/owa, in a Web browser and then provide their network credentials when prompted. Users can also typically launch Outlook Web App from the internal network by typing the internal server name followed by the Outlook Web App virtual directory name, such as https://mailserver/owa, in a Web browser. Network user credentials are also required when launching Outlook Web App from the internal network.

The URLs that users use to access Exchange 2010 Outlook Web App are configured using the following parameters on the Set-OwaVirtualDirectory cmdlet:

• InternalUrl   This parameter specifies the URL used by users on your internal network to access Exchange 2010 Outlook Web App. For example, https://ex2010.corp.contoso.com/owa.
  
  
• ExternalUrl   This parameter specifies the URL used by users to access Exchange 2010 Outlook Web App from the Internet. For example, https://mail.contoso.com/owa.
  
  

Learn more at: Managing Outlook Web App Virtual Directories

In a hybrid deployment, you’re typically moving existing user mailboxes from your on-premises Exchange 2010 mailbox server to the cloud-based organization in phases. Maintaining the ability to access mailboxes using a Web browser for users during mailbox migration is often very important.

Outlook Web App is available for user mailboxes that are moved to the cloud-based organization. Typically, the URL that a user needs to specify to access Outlook Web App depends on whether a user's mailbox is located on an on-premises Exchange 2010 server or in the cloud-based organization. The hybrid server, however, enables you to provide a single Outlook Web App address which will either automatically redirect your users to the correct Outlook Web App URL or provide them with the correct URL. We recommend that you configure the hybrid server to handle Outlook Web App requests and use a single URL to access user mailboxes.

Using the installed Client Access server role, you can configure the hybrid server to take one of the following actions depending on the location of the user's mailbox:

• Mailbox on the on-premises server   For mailboxes located on the on-premises Exchange 2010 mailbox server, the hybrid server looks up the internal or external URL of a Exchange 2010 Client Access server, and redirects the user to that URL automatically. The user then communicates directly with the Exchange 2010 Client Access server to access Outlook Web App.
  
  Learn more at: Understanding Proxying and Redirection
  
  
• Mailbox in the cloud   For mailboxes located in the cloud-based organization, Outlook Web App requests made to the hybrid server are not automatically redirected to the cloud-based organization. Instead, the hybrid server displays a Web page that provides users with a link to the Outlook Web App endpoint for the cloud-based organization. Users also have the option to save the URL as a favorite in their Web browser.
  
  

Configuring the hybrid server to take these actions requires the following process:

1. Configure the Outlook Web App virtual directory on the Exchange 2010 Client Access servers with the internal and external URLs users use to access Exchange 2010 Outlook Web App.
   
   
2. Configure the organization relationship on the hybrid server to display the cloud-based Outlook Web App URL for user mailboxes located in the cloud-based organization.
   
   
3. Update the existing DNS record to direct Outlook Web App requests to the hybrid server.
   
   

This configuration requires that both the Exchange 2010 Client Access server and the hybrid server accept Outlook Web App connections from the Internet. This is because the hybrid server redirects Outlook Web App requests to the Exchange 2010 Client Access server. Each server requires its own public IP address and TCP ports 80 and 443 to be opened on your firewall.