Applies to: Exchange Server 2013, Exchange Online
Topic Last Modified: 2014-05-22
A hybrid deployment offers organizations the ability to extend the feature-rich experience and administrative control they have with their existing on-premises Microsoft Exchange organization to the cloud. A hybrid deployment provides the seamless look and feel of a single Exchange organization between an on-premises Exchange Server 2013 organization and Exchange Online in Microsoft Office 365. In addition, a hybrid deployment can serve as an intermediate step to moving completely to an Exchange Online organization.
Looking for a list of all hybrid deployment topics? See Hybrid deployment documentation. You may also want to check Release notes for Exchange 2013. And, if you would like an offline version of this Help content, you can download the Help file from the Microsoft Download Center.
 Important: |
|---|
| This feature of Exchange Server 2013 isn’t fully compatible with Office 365 operated by 21Vianet in China and some feature limitations may apply. For more information, see Learn about Office 365 operated by 21Vianet. |
Contents
Things to consider before configuring a hybrid deployment
Hybrid deployment documentation
Key terminology
The following list provides you with definitions of the core components associated with hybrid deployments in Exchange 2013.
- centralized mail transport
-
The hybrid configuration option in which all Exchange Online inbound and outbound Internet messages are routed via the on-premises Exchange organization. This routing option is configured in the Hybrid Configuration wizard. For more information, see Transport options in Exchange 2013 hybrid deployments.
- coexistence domain
-
An accepted domain added to the on-premises organization for hybrid mail flow and Autodiscover requests for the Office 365 service. This domain is added as a secondary proxy domain to any email address policies which have PrimarySmtpAddress templates for domains selected in the Hybrid Configuration wizard. By default, this domain is <domain>.mail.onmicrosoft.com.
- HybridConfiguration Active Directory object
-
The Active Directory object in the on-premises organization that contains the desired hybrid deployment configuration parameters defined by the selections chosen in the Hybrid Configuration wizard. The Hybrid Configuration Engine uses these parameters when configuring on-premises and Exchange Online settings to enable hybrid features. The contents of the HybridConfiguration object are reset each time the Hybrid Configuration wizard is run.
- hybrid configuration engine (HCE)
-
The Hybrid Configuration Engine executes the core actions necessary for configuring and updating a hybrid deployment. The HCE compares the state of the HybridConfiguration Active Directory object with current on-premises Exchange and Exchange Online configuration settings and then executes tasks to match the deployment configuration settings to the parameters defined in the HybridConfiguration Active Directory object. For more information, see Hybrid Configuration Engine.
- hybrid configuration wizard (HCW)
-
An adaptive tool offered in Exchange 2013 that guides administrators through configuring a hybrid deployment between their on-premises and Exchange Online organizations. The wizard defines the hybrid deployment configuration parameters in the HybridConfiguration object and instructs the Hybrid Configuration Engine to execute the necessary configuration tasks to enable the defined hybrid features. For more information, see Hybrid Configuration wizard.
- Exchange 2010-based hybrid deployment
-
A hybrid deployment configured using Service Pack 3 (SP3) for Exchange Server 2010 on-premises servers as the connecting endpoint for the Office 365 and Exchange Online services. A hybrid deployment option for on-premises Exchange 2010, Exchange Server 2007, and Exchange Server 2003 organizations and compatible with Office 365 service versions 14.0.000.0 and 15.0.000.0.
- Exchange 2013-based hybrid deployment
-
A hybrid deployment configured using Exchange 2013 on-premises servers as the connecting endpoint for the Office 365 and Exchange Online services. A hybrid deployment option for on-premises Exchange 2013, Exchange 2010, and Exchange 2007 organizations and compatible with Office 365 service version 15.0.000.0 or later only.
- secure mail transport
-
An automatically configured feature of a hybrid deployment that enables secure messaging between the on-premises and Exchange Online organizations. Messages are encrypted and authenticated using transport layer security (TLS) with a certificate selected in the Hybrid Configuration wizard. The Exchange Online Protection (EOP) service in the Office 365 tenant is the endpoint for hybrid transport connections originating from the on-premises organization and the source for hybrid transport connections to the on-premises organization from Exchange Online.
Hybrid deployment features
A hybrid deployment enables the following features:
Hybrid deployment components
A hybrid deployment involves several different services and components:
-
Exchange 2013 servers Exchange 2013 Client Access and Mailbox server roles are required in your on-premises Exchange organization. If needed, Exchange 2013 Edge Transport servers can also be installed in a perimeter network and support hybrid connectivity with Office 365.
Note:On-premises Exchange 2013 servers with the Client Access (CAS) or Mailbox server roles used for hybrid feature support should not be deployed in a perimeter network and isn’t supported. -
Microsoft Office 365 The Office 365 service provides a cloud-based Exchange Online organization as a part of its subscription service. Organizations configuring a hybrid deployment must create and configure this cloud-based Exchange Online organization.
-
Exchange Online Protection The Microsoft Exchange Online Protection service (EOP) is included in all Office 365 for enterprises tenants by default and works with on-premises Exchange 2013 Client Access servers to provide secure message delivery between the on-premises and Exchange Online organizations. Depending on how your organization is configured, it may also handle routing incoming mail from external recipients for your Exchange Online organization and your on-premises Exchange organization.
-
Hybrid Configuration wizard Exchange 2013 includes the Hybrid Configuration wizard which provides you with a streamlined process to configure a hybrid deployment between on-premises Exchange and Exchange Online organizations.
Learn more at Hybrid Configuration wizard.
-
Windows Azure AD authentication system The Windows Azure AD authentication system is a free cloud-based service that acts as the trust broker between your on-premises Exchange 2010 organization and the Exchange Online organization. On-premises organizations configuring a hybrid deployment must have a federation trust with the Windows Azure AD authentication system. The federation trust can either be created manually as part of configuring federated sharing features between an on-premises Exchange organization and other federated Exchange organizations or as part of configuring a hybrid deployment with the Hybrid Configuration wizard. A federation trust with the Windows Azure AD authentication system for your Office 365 tenant is automatically configured when you activate your Office 365 service account.
Learn more at Windows Azure AD authentication system.
-
Active Directory synchronization Active Directory synchronization replicates on-premises Active Directory information for mail-enabled objects to the Office 365 organization to support the unified global address list (GAL). Organizations configuring a hybrid deployment must deploy Active Directory synchronization on a separate, on-premises server.
Learn more at Directory synchronization roadmap.
Hybrid deployment example
Take a look at the following scenario. It's an example topology that provides an overview of a typical Exchange 2013 deployment. Contoso, Ltd. is a single-forest, single-domain organization with two domain controllers, one Exchange 2013 server with the Client Access role installed, and one Exchange 2013 server with the Mailbox server role installed. Remote Contoso users use Outlook Web App to connect to Exchange 2013 over the Internet to check their mailboxes and access their Outlook calendar.
Let's say that you’re the network administrator for Contoso and you’re interested in configuring a hybrid deployment. You deploy and configure a required Active Directory Synchronization server and you also decide to deploy an Active Directory Federation Services server as an option to minimize the number of prompts for account credentials for Contoso users and administrators accessing Office 365 services. After you complete the hybrid deployment prerequisites and use the Hybrid Configuration wizard to select options for the hybrid deployment, your new topology has the following configuration:
-
Users will use their existing network account credentials for logging on to the on-premises and Exchange Online organizations (“single sign-on”).
-
User mailboxes located on-premises and in the Exchange Online organization will use the same email address domain. For example, mailboxes located on-premises and mailboxes located in the Exchange Online organization will both use @contoso.com in user email addresses.
-
All mail is delivered to the Internet by the on-premises organization. The on-premises organization controls all messaging transport and serves as a relay for the Exchange Online organization (“centralized mail transport”).
-
On-premises and Exchange Online organization users can share calendar free/busy information with each other. Organization relationships configured for both organizations also enable cross-premises message tracking, MailTips, and message search.
-
On-premises and Exchange Online users use the same URL to connect to their mailboxes over the Internet.
If you compare Contoso's existing organization configuration and the hybrid deployment configuration, you'll see that configuring a hybrid deployment has added servers and services that support additional communication and features that are shared between the on-premises and Exchange Online organizations. Here's an overview of the changes that a hybrid deployment has made from the initial on-premises Exchange organization.
| Configuration | Before hybrid deployment | After hybrid deployment |
|---|---|---|
|
Mailbox location |
Mailboxes on-premises only. |
Mailboxes on-premises and in Exchange Online. |
|
Message transport |
On-premises Client Access servers handle all inbound and outbound message routing. |
On-premises Client Access server handles internal message routing between the on-premises and Exchange Online organization. |
|
Outlook Web App |
On-premises Client Access server receives all Outlook Web App requests and displays mailbox information. |
On-premises Client Access server redirects Outlook Web App requests to either the on-premises Exchange 2013 Mailbox server or provides a link to log on to the Exchange Online organization. |
|
Unified GAL for both organizations |
Not applicable; single organization only. |
On-premises Active Directory synchronization server replicates Active Directory information for mail-enabled objects to the Exchange Online organization. |
|
Single-sign on used for both organizations |
Not applicable; single organization only. |
On-premises Active Directory Federation Services (AD FS) server supports using single-sign on credentials for mailboxes located either on-premises or in the Office 365 organization. |
|
Organization relationship established and a federation trust with the Windows Azure AD authentication system |
Trust relationship with the Windows Azure AD authentication system and organization relationships with other federated Exchange organizations may be configured. |
Trust relationship with the Windows Azure AD authentication system is required. Organization relationships are established between the on-premises and Exchange Online organization. |
|
Free/busy sharing |
Free/busy sharing between on-premises users only. |
Free/busy sharing between both on-premises and Exchange Online users. |
Things to consider before configuring a hybrid deployment
Now that you're a little more familiar with what a hybrid deployment is, you need to carefully consider some important issues. Configuring a hybrid deployment could affect multiple areas in your current network and Exchange organization.
Supported organizations
Active Directory synchronization between the on-premises and Office 365 organizations is a requirement for configuring a hybrid deployment. The Microsoft Office 365 service has an upper limit for replicating mail-enabled Active Directory objects to the cloud-based organization of 50,000 objects. If your Active Directory environment contains more than 50,000 objects, contact the Microsoft Online Services support team to open a service request for an exception and indicate the number of objects you need to synchronize.
Hybrid deployment management
You manage a hybrid deployment in Exchange 2013 via a single unified management console that allows for managing both your on-premises and Office 365 Exchange Online organizations. The Exchange admin center (EAC), which replaces the Exchange Management Console and the Exchange Control Panel, allows you to connect and configure features for both organizations. When you run the Hybrid Configuration wizard for the first time, you will be prompted to connect to your Exchange Online organization. You must use an Office 365 account that is a member of the Organization Management role group to connect the EAC to your Exchange Online organization.
Certificates
Secure Sockets Layer (SSL) digital certificates play a significant role in configuring a hybrid deployment. They help to secure communications between the on-premises hybrid server and the Exchange Online organization. Certificates are a requirement to configure several types of services. If you're already using digital certificates in your Exchange organization, you may have to modify the certificates to include additional domains or purchase additional certificates from a trusted certificate authority (CA). If you aren't already using certificates, you will need to purchase one or more certificates from a trusted CA.
Learn more at Certificate requirements for hybrid deployments.
Bandwidth
Your network connection to the Internet will directly impact the communication performance between your on-premises organization and the Exchange Online organization. This is particularly true when moving mailboxes from your on-premises Exchange 2013 server to the Exchange Online organization. The amount of available network bandwidth, in combination with mailbox size and the number of mailboxes moved in parallel, will result in varied times to complete mailbox moves. Additionally, other Office 365 cloud-based services, such as Microsoft SharePoint 2013 and Microsoft Lync Server 2013, may also affect the available bandwidth for messaging services.
Before moving mailboxes to the Exchange Online organization, you should:
-
Determine the average mailbox size for mailboxes that will be moved to the Exchange Online organization.
-
Determine the average connection and throughput speed for your connection to the Internet from your on-premises organization.
-
Calculate the average expected transfer speed, and plan your mailbox moves accordingly.
Learn more at Networking.
Unified Messaging
Unified Messaging (UM) is supported in a hybrid deployment between your on-premises and Exchange Online organizations. Your on-premises telephony solution must be able to communicate with the Exchange Online organization. This may require that you purchase additional hardware and software.
If you want to move mailboxes from your on-premises organization to the Exchange Online organization, and those mailboxes are configured for UM, you should configure UM in your hybrid deployment prior to moving those mailboxes. If you move mailboxes before you configure UM in your hybrid deployment, those mailboxes will no longer have access to UM functionality.
Learn more at Plan for UM Coexistence.
Information Rights Management
Information Rights Management (IRM) enables users to apply Active Directory Rights Management Services (AD RMS) templates to messages that they send. AD RMS templates can help prevent information leakage by allowing users to control who can open a rights-protected message, and what they can do with that message after it's been opened.
IRM in a hybrid deployment requires planning, manual configuration of the Exchange Online organization, and an understanding of how clients use AD RMS servers depending on whether their mailbox is in the on-premises or Exchange Online organization.
Mobile devices
Mobile devices are supported in a hybrid deployment. If Exchange ActiveSync is already enabled on Client Access servers, they’ll continue to redirect requests from mobile devices to mailboxes located on the on-premises Mailbox server. For mobile devices connecting to existing mailboxes that are moved from the on-premises organization to Exchange Online, the Exchange ActiveSync partnership must be disabled and re-established before redirection requests are processed correctly. All mobile devices that support Exchange ActiveSync should be compatible with a hybrid deployment.
Learn more at Mobile Phones.
Client requirements
We recommend that you use Microsoft Outlook 2013 or Outlook 2010 for the best experience and performance in the hybrid deployment. Pre-Outlook 2010 clients have limited support in hybrid deployments and with the Office 365 service.
Licensing for the Office 365 service
To create mailboxes in, or move mailboxes to, an Exchange Online organization, you need to sign up for Office 365 for enterprises and you must have licenses available. When you sign up for Office 365, you'll receive a specific number of licenses that you can assign to new mailboxes or mailboxes moved from the on-premises organization. Each mailbox in the Exchange Online service must have a license.
Antivirus and anti-spam services
Mailboxes moved to the Exchange Online organization are automatically provided with antivirus and anti-spam protection by Microsoft Exchange Online Protection (EOP). We recommend that you carefully evaluate whether the EOP protection in your Exchange Online organization is also appropriate to meet the antivirus and anti-spam needs of your on-premises organization. If you have protection in place for your on-premises organization, you may need to upgrade or configure your on-premises antivirus and anti-spam solutions for maximum protection across your organization.
Learn more at: Anti-spam and anti-malware protection
Public folders
Public folders are now supported in Office 365 and on-premises public folders can be moved to Exchange Online. However, Exchange Online mailboxes can only access public folders located in Exchange Online and on-premises mailboxes can only access public folders in the on-premises Exchange organization. Existing on-premises public folder configuration and access for on-premises mailboxes doesn’t change when you configure a hybrid deployment.
Hybrid deployment documentation
The following table contains links to topics that will help you learn about and manage hybrid deployments in Microsoft Exchange.
| Topic | Description |
|---|---|
|
Learn more about the updates to hybrid deployments and the Hybrid Configuration wizard in Exchange 2013. |
|
|
Learn how the Hybrid Configuration wizard and the Hybrid Configuration Engine configure a hybrid deployment. |
|
|
Learn more about hybrid deployment prerequisites, including compatible Exchange Server organizations, Office 365 requirements, and other on-premises configuration requirements. |
|
|
Learn more about the requirements for digital certificates in hybrid deployments. |
|
|
Learn more about the inbound and outbound message transport options in hybrid deployments. |
|
|
Learn more about inbound and outbound message routing options in a hybrid deployment. |
|
|
Learn more about managing your hybrid deployment with the Exchange admin center and Exchange Management Shell. |
|
|
Learn more about calendar free/busy sharing between on-premises and Exchange Online organizations in a hybrid deployment. |
|
|
Learn more about how the Exchange 2013 Client Access and Mailbox server roles function in a hybrid deployment. |
|
|
Learn more about how Information Rights Management functions in a hybrid deployment. |
|
|
Learn more about how a hybrid deployment uses Role Based Access Control (RBAC) to control permissions. |
|
|
Learn more about Exchange 2010 Edge Transport servers and how they are deployed and operate in a hybrid deployment. |
|
|
Learn more about how single sign-on using Active Directory Federation Services (AD FS) functions in a hybrid deployment. |
|
|
Learn more about configuring a hybrid deployment between a multi-forest on-premises Exchange organization and a single Exchange Online tenant. |
|
|
Explore procedures for creating and modifying hybrid deployments for your Exchange 2013 on-premises and Exchange Online organizations. |
|
|
Learn more about Exchange 2013-based hybrid deployments with Exchange 2010 organizations. |
|
|
Learn more about Exchange 2013-based hybrid deployments with Exchange 2007 organizations. |