# How to Migrate from Exchange Server to Microsoft 365 using Hybrid Configuration Wizard
Migrating enterprise email from an on-premises Microsoft Exchange Server to Microsoft 365 (formerly Office 365) is a major IT undertaking. While a “Cutover” migration is suitable for small organizations that want to move everyone over a single weekend, medium-to-large enterprises require a phased approach.
A Hybrid deployment is the only supported method that allows an organization to seamlessly bridge an on-premises Exchange environment with Exchange Online, allowing users in both environments to share the same domain, view unified free/busy calendar information, and maintain a centralized global address list during a prolonged migration period.
This guide details the technical workflow for configuring this environment using the Microsoft Exchange Hybrid Configuration Wizard (HCW).
## Prerequisites and Infrastructure Requirements
Before running the HCW, your on-premises environment must meet strict requirements:
1. **Exchange Version:** You must be running Exchange Server 2016 or Exchange Server 2019. (Exchange 2013 is out of support, and Exchange 2010 requires a legacy approach). The servers must be updated to the latest Cumulative Update (CU), or at minimum, the immediately preceding CU.
2. **Azure AD Connect:** This is non-negotiable. You must have Azure AD Connect (now Microsoft Entra Connect) installed, configured, and actively syncing your on-premises Active Directory users to your Microsoft 365 tenant. The “Exchange Hybrid Deployment” option must be checked during the Entra Connect setup.
3. **Custom Domain:** Your custom domain (e.g., `corp.com`) must be verified in your Microsoft 365 tenant.
4. **Public SSL Certificate:** Your on-premises Exchange server (specifically the Client Access services) must have a valid third-party SSL certificate (e.g., DigiCert, Let’s Encrypt). Self-signed certificates are not supported for hybrid mail flow.
5. **Autodiscover:** Your public DNS must have a valid Autodiscover record pointing to your on-premises Exchange environment.
## Step 1: Prepare the Microsoft 365 Tenant
Ensure your tenant is ready to accept the hybrid connection.
1. Log in to the **Exchange admin center (EAC)** in Microsoft 365.
2. Navigate to **Mail flow > Accepted domains**. Ensure your custom domain is listed and set to **Authoritative** (if all mailboxes will eventually be in the cloud) or **Internal Relay** (if you intend to keep some mailboxes on-premises permanently).
3. Ensure you possess global administrator credentials for the tenant.
## Step 2: Download and Launch the HCW
The Hybrid Configuration Wizard is a standalone application downloaded from Microsoft. It should be run from an on-premises Exchange server.
1. Log in to your on-premises Exchange Admin Center.
2. Navigate to the **Hybrid** node in the left-hand navigation pane.
3. Click the **Configure** button to download the HCW executable (`Microsoft.Online.CSE.Hybrid.App.application`).
4. Launch the application.
## Step 3: Executing the Hybrid Configuration Wizard
The HCW automates complex PowerShell scripts to bind the two environments. Follow these precise steps:
1. **Server Detection:** The wizard will detect your optimal on-premises Exchange server. Click Next.
2. **Credentials:** You will be prompted to enter credentials for both environments.
– For on-premises, use an account that is a member of the **Enterprise Admins** and **Organization Management** groups.
– For Microsoft 365, use an account with **Global Administrator** privileges. (The HCW fully supports Multi-Factor Authentication).
3. **Hybrid Features:** Select **Full Hybrid Configuration**. (Minimal Hybrid is only used if you plan to migrate all mailboxes within a few weeks and do not care about unified free/busy sharing).
4. **Hybrid Topology:**
– **Classic Hybrid Topology:** Requires inbound ports (25 and 443) to be open on your corporate firewall pointing to your Exchange servers. This is the traditional and most robust method.
– **Modern Hybrid Topology:** Uses the Microsoft Hybrid Agent, an outbound-only proxy. This requires no inbound firewall rules but has limitations (e.g., it does not support Teams calendar integration for on-premises mailboxes).
*For this guide, we assume the standard **Classic Hybrid Topology**.*
5. **On-premises Account for Migration:** Provide the credentials of the on-premises administrator account that the Microsoft 365 cloud will use to connect to your on-premises server to pull mailbox data via the Migration Endpoint (Exchange Web Services).
6. **Mail Flow Configuration:**
– Choose how you want emails to route between the internet, your on-premises servers, and Microsoft 365.
– The typical choice is to have your on-premises Exchange servers handle internet mail routing until all mailboxes are migrated.
7. **Receive Connector Configuration:** Select the on-premises Exchange server(s) that will receive emails from Microsoft 365.
8. **Send Connector Configuration:** Select the on-premises Exchange server(s) that will send emails to Microsoft 365.
9. **Transport Certificate:** Select the third-party SSL certificate installed on your Exchange server. The HCW uses this certificate to establish a TLS-encrypted connector between your data center and Microsoft 365.
10. **Organization FQDN:** Enter the externally accessible Fully Qualified Domain Name of your on-premises Exchange server (e.g., `mail.corp.com`). This must match the name on your SSL certificate.
## Step 4: Finalize and Verify
Click **Update** to execute the configuration. The HCW will now connect to both environments via PowerShell, create the necessary Send and Receive Connectors, configure Organization Relationships, and establish the Federation Trust.
If the wizard completes without errors, your hybrid environment is established.
### Verification Testing
Before scheduling user migrations, you must verify the hybrid bond is functioning correctly:
1. **Free/Busy Sharing:** Log in to an on-premises mailbox via Outlook. Attempt to schedule a meeting with a user whose mailbox is already in Microsoft 365. You should be able to see their calendar availability, and vice versa.
2. **Mail Flow:** Send a test email from an on-premises mailbox to a Microsoft 365 mailbox. Examine the email headers in the recipient’s inbox; the email should be marked as “Internal” rather than originating from the internet, bypassing standard spam filtering.
3. **Migration Endpoint:** In the Microsoft 365 Exchange admin center, navigate to **Migration > Endpoints**. Verify that an Exchange Remote endpoint exists and successfully connects to your on-premises `mail.corp.com` FQDN.
With the Hybrid Configuration complete and verified, you are now ready to begin non-disruptive, phased mailbox migrations to Microsoft 365.