The following prerequisites are required for configuring a hybrid deployment:

• On-premises Exchange organization   Hybrid deployments can be configured for on-premises Exchange 2007-based organizations or later. For Exchange 2007 and Exchange 2010 organizations, at least one Exchange 2013 Client Access and one Exchange 2013 Mailbox server must be installed in the on-premises organization to run the Hybrid Configuration wizard and support Exchange 2013-based hybrid deployment functionality. We recommend combining the Exchange 2013 Client Access and Mailbox server roles on a single server when configuring hybrid deployments with Exchange 2007 and Exchange 2010 environments. All on-premises Exchange 2013 servers must have installed Cumulative Update 1 (CU1) or greater for Exchange 2013 to support hybrid functionality with Office 365. For more information, see Updates for Exchange 2013.

   

  For a complete listing of Exchange Server and Office 365 for enterprises tenant hybrid deployment compatibility, see the requirements listed in the following table for Exchange 2013-based and Exchange 2010-based hybrid deployments.

  Note:
  To verify your Office 365 tenant version and status, see Verify Office 365 tenant version and status later in this topic.

  On-premises environment	Exchange 2010-based hybrid with tenant version v14	Exchange 2010-based hybrid with tenant version v15	Exchange 2013-based hybrid with tenant version v15
  Exchange 2013 SP1	Not supported1	Not applicable	Supported
  Exchange 2010 SP3	Supported	Supported	Supported5
  Exchange 2010 SP2	Supported	Not supported2	Not supported
  Exchange 2010 SP1	Supported	Not supported2	Not supported
  Exchange 2007 SP3 RU10	Supported3	Supported4	Supported5
  Exchange 2007 SP3	Supported3	Not Supported	Not supported
  Exchange 2003 SP2	Supported3	Supported4	Not supported

  Note:
  1 Blocked in Exchange 2013 setup 2 Tenant upgrade notification provided in Exchange Management Console 3 Requires at least one on-premises Exchange 2010 SP2 server 4 Requires at least one on-premises Exchange 2010 SP3 server 5 Requires at least one on-premises Exchange 2013 CU1 or greater server

• Office 365   Hybrid deployments are supported in all Office 365 plans that support Windows Azure Active Directory synchronization. All Office 365 Enterprise, Government, Academic and Midsize plans support hybrid deployments. Office 365 Small Business and Home plans don’t support hybrid deployments. The Office 365 tenant version must be 15.0.620.28 or greater to configure a hybrid deployment with Exchange 2013. Additionally, your Office 365 tenant status must not be transitioning between service versions. For a complete summary, see the preceding table. To verify your Office 365 tenant version and status, see Verify Office 365 tenant version and status later in this topic.

  Learn more at Sign up for Office 365.

   

• Custom domains   Register any custom domains you want to use in your hybrid deployment with Office 365. You can do this by using the Office 365 Administrative portal, or by optionally configuring Active Directory Federation Services (AD FS) in your on-premises organization.

  Learn more at Add your domain to Office 365.

   

• Active Directory synchronization   Deploy the Windows Azure Active Directory Sync tool for Active Directory synchronization with your on-premises organization.

  Learn more at Active Directory synchronization: Roadmap.

   

• Autodiscover DNS records   Configure the Autodiscover public DNS records for your existing SMTP domains to point to an on-premises Exchange 2013 Client Access server.

   

• Office 365 organization in the Exchange admin center (EAC)   The Office 365 organization node is included by default in the on-premises EAC, but you must connect the EAC to your Office 365 organization using your Office 365 tenant administrator credentials before you can use the Hybrid Configuration wizard. This also allows you to manage both the on-premises and Exchange Online organizations from a single management console.

  Learn more at Hybrid management in Exchange 2013 hybrid deployments.

   

• Certificates   Install and assign Exchange services to a valid digital certificate purchased from a trusted public certificate authority (CA). Although self-signed certificates should be used for the on-premises federation trust with the Microsoft Federation Gateway, self-signed certificates can’t be used for Exchange services in a hybrid deployment. The Internet Information Services (IIS) instance on the Client Access servers configured in the hybrid deployment must have a valid digital certificate purchased from a trusted CA. Additionally, the EWS external URL and the Autodiscover endpoint specified in your public DNS must be listed in Subject Alternative Name (SAN) of the certificate. The certificate installed on the Mailbox and Client Access (and Edge Transport if deployed) servers used for mail transport in the hybrid deployment must all use the same certificate (that is, they are issued by the same CA and have the same subject).

  Learn more at Certificate requirements for hybrid deployments.

   

• EdgeSync   If you’ve deployed Edge Transport servers in your on-premises organization and want to configure the Edge Transport servers for hybrid secure mail transport, you must configure EdgeSync prior to using the Hybrid Configuration wizard.

  Important:
  Although EdgeSync is a requirement in deployments with Edge Transport servers, additional manual transport configuration settings will be required when you configure Edge Transport servers for hybrid secure mail transport.

  Learn more at Edge Transport servers with hybrid deployments.

   

Hybrid deployment features and components require certain incoming protocols, ports and connection endpoints to be accessible to Office 365 in order to work correctly. Before configuring your hybrid deployment, verify that your on-premises network and security configuration can support the features and components in the table below:

In addition to the required prerequisites described earlier, other tools and services are beneficial when you’re configuring hybrid deployments with the Hybrid Configuration wizard:

• Exchange Server Deployment Assistant   Exchange Server Deployment Assistant is a free web-based tool that helps you deploy Exchange 2013 in your on-premises organization, configure a hybrid deployment between your on-premises organization and Office 365, or migrate completely to Office 365. The tool asks you a small set of simple questions and then, based on your answers, creates a customized checklist with instructions to deploy or configure Exchange Server. The Deployment Assistant gives you exactly the right information you need to configure your hybrid deployment.

  Learn more at Exchange Server Deployment Assistant.

   

• Remote Connectivity Analyzer tool   The Microsoft Remote Connectivity Analyzer tool checks the external connectivity of your on-premises Exchange organization and makes sure that you’re ready to configure your hybrid deployment. We strongly recommend that you check your on-premises organization with the Remote Connectivity Analyzer tool prior to configuring your hybrid deployment with the Hybrid Configuration wizard.

  Learn more at Remote Connectivity Analyzer Tool.

   

• Single sign-on   Although not a requirement for hybrid deployments, single sign-on enables users to access both the on-premises and Exchange Online organizations with a single user name and password. Single sign-on provides users with a familiar sign-on experience and allows administrators to easily control account policies for Exchange Online organization mailboxes by using on-premises Active Directory management tools.

  Single sign-on is also highly recommended for organizations that plan on deploying Exchange Online Archiving (EOA) in their Exchange organization.

  If you decide to deploy single sign-on with your hybrid deployment, we recommend that you deploy it with Active Directory synchronization and before using the Hybrid Configuration wizard.

  Learn more at Prepare for single sign-on.

To verify the version and status of your Office 365 tenant, follow the steps below:

1. Connect to the Office 365 tenant using remote Windows PowerShell. For step-by-step connection instructions, see Connect Windows PowerShell to the Service.

2. After connecting to the Office 365 tenant, run the following command.

   	Copy Code
   Get-OrganizationConfig | Format-List AdminDisplayVersion,IsUpgradingOrganization

   Verify that your Office 365 tenant and status meet the following requirements:

   • AdminDisplayVersion parameter value is equal to or greater than 15.0.620.28

   • IsUpgradingOrganization parameter is False

   For example, “0.20 (15.0.620.51)” and “False”.

   Warning:
   If your Office 365 tenant version and status don’t meet the hybrid deployment requirements, the Hybrid Configuration wizard won’t complete successfully.

3. Disconnect from the Office 365 tenant remote PowerShell session. For step-by-step disconnection instructions, see Connect Windows PowerShell to the Service.