This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 92%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELJ%3C/text%3E%3C/svg%3E)
Hi all,
Our service provicer told us we need to change the AD Connect tool to enable the option: "Exchange hybrid deployment".
Is this change with any risk?
Leo
Every change has risk :)
But no, this is a pretty easy and common option. And if you need to do it, then you really have no alternative :)
Here are the attributes synced once enabled
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-sync-attributes-synchronized#exchange-online
and written back to on-prem
Troubleshooting usually involves permissions:
Thanks!
Do we have to use the same account which we installed and configured AD Connect or will any Global Administrator account suffice?
Sorry, it's a really new to us.
On the Azure side, any Global Admin account will work.
On the AADConnect/on-prem side, you will should logon and use the connector account:
You can set permissions for Hybrid:
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-configure-ad-ds-connector-account#permissions-for-exchange-hybrid-deployment
Is it optional to set the permissions for Exchange Hybrid Deployment or is it mandatory?
Really thankfull for your help.
Mandatory if you want writeback to work :)
If those permissions are enabled, you will see permissions errors in the sync logs ( and alot of them!)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 67%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
Hi @Leo Johnson
Andy has given quite helpful reply about your question.
The Exchange hybrid deployment feature allows for the coexistence of Exchange mailboxes both on-premises and in Microsoft 365. Azure AD Connect synchronizes a specific set of attributes from Azure AD back into your on-premises directory.
And here is also a related thread discussed about the similar question: Azure AD Connect and "Exchange hybrid deployment" write-back
The official document which introduces about Azure AD Connect: Accounts and permissions for your reference as well
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.