Hybrid agent setup failing on "Validating Hybrid Agent for Exchange usage

Hello,

I had the same problem and it is related to Exchange Extended Protection.

To solve the problem, you need to get the Powershell script from

https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-extended-protection?view=exchserver-2019#extended-protection-and-modern-hybrid-configuration

Then execute this command:

.\ExchangeExtendedProtectionManagement.ps1 -ExchangeServerNames MHServer1, MHServer2 -ExcludeVirtualDirectories "EWSFrontEnd"

You can check bellow things

1. Verify Prerequisites

• Ensure you're running the latest version of the Hybrid Configuration Wizard
• Confirm your Exchange servers meet the hybrid deployment prerequisites
• Verify your on-premises Exchange servers are running supported CU versions

2. Check Network Connectivity

• Test connectivity to all required Office 365 endpoints
• Ensure TCP port 443 is open to:
  • outlook.office365.com
  • hybrid.office365.us (or your specific region endpoint)
  • autodiscover.yourdomain.com

3. Validate Authentication

• Ensure the account running the wizard has:
  • Organization Management role in Exchange Online
  • Enterprise Admin rights in on-premises AD
  • Hybrid Agent Administrator role (if using Modern Hybrid)

4. Examine the Log File

Since you've shared a log file (20240312_070138.log), look for these key details:

• Any HTTP 401/403 errors indicating authentication failures
• Certificate validation errors
• Specific endpoint connection failures
• Timeout messages

5. Specific Fixes to Try

• Reset the Hybrid Agent:

  
    Remove-HybridAgent
  
    Install-HybridAgent
  
  

• Update Exchange certificates if near expiration
• Run the Hybrid Configuration Wizard in elevated mode (Run as Administrator)

Hi there, I know this is an older post but I had a similar issue and wanted to give my solution.

I am using an Exchange Server 2019 with the latest CU. I installed the hybrid agent and got the point "validate hybrid agent for exchange usage" (as shown in the screenshot above).

My error message was along the lines of "the http request is unauthorized with client authentication scheme 'negotiate' exchange migration" (not the same as in the orignal post).

I checked my extended protection as shown here and it was configured wrong (enabled on all directories) https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-extended-protection?view=exchserver-2019#extended-protection-and-modern-hybrid-configuration

As a temporary fix I disabled extended protection and the setup worked flawlessly. A Test Migration also went without issues.

Tomorrow I will follow the advice of valentinBoch and configure EEP correctly (.\ExchangeExtendedProtectionManagement.ps1 -ExchangeServerNames MHServer1, MHServer2 -ExcludeVirtualDirectories "EWSFrontEnd" ). This is also explained in the learn article above.

PS: Thank you guys for your help!!

Hi @Jabulani Motloung I got the exactly the same issue, would you be able to elaborate on how it was sorted please.

@Yuki Sun-MSFT

I ran the cmd as per your instructed above with mine'76101ba2-ccfb-4c99-972e-8de7fc7910d7.resource.mailboxmigration.his.msappproxy.net'

it failed with the same error in the log.

So you know it was fine before, all of a sudden it stopped working.

Any help/ advice would be appreciated

Cheers

Hi @Jabulani Motloung ,

Connect to Exchange Online PowerShell and run the command below after replacing "domain\admin" with the on-premises migration admin you are using:

Test-MigrationServerAvailability -ExchangeRemoteMove: $true -RemoteServer 'dd500728-4fec-405f-a706-a3b245576f1f.resource.mailboxmigration.his.msappproxy.net' -Credentials (Get-Credential -UserName domain\admin)

If you get the same error, check the Hybrid Agent Status (ACTIVE or INACTIVE) by re-running Modern HCW and check it in the GUI, reference here.

If the Hybrid Agent is ACTIVE, check and confirm with Performance Monitor that you see the requests. If the request counters (for #of requests) go up on the Agent machine when you do Test-MigrationServerAvailability to the Hybrid Agent, it's likely to be an issue with the on-premises infrastructure, especially proxy and firewall settings. Then please go through the links below and make sure all the requirements have been met:

• install requirements
• system requirements
• port and protocol requirements

Reference: Troubleshooting Hybrid Migration Endpoints in Classic and Modern Hybrid -Scenario 1: Test-MigrationServerAvailability fails because of connectivity / timeout errors.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.