Setting up Exchange 365 hybrid for .local domain

Question

We have a .local domain. About 4 years ago, I began setting up Office 365 for our organization by adding a new UPN Suffix that matches our external domain, and it has worked well. We have been using Azure AD Connect to sync users, and we use everything except for Exchange 365. Our email is still hosted on our own Exchange 2016 server and our MX records point to our Barracuda SPAM filter, which forwards to our server after SPAM checking.

I would like to now move to Exchange 365 online from Exchange 2016. I have been reading up on how to set up a hybrid Exchange connection between the on premises server and Exchange online.

I have a few questions:

1. When the Hybrid Configuration Wizard asks for the FQDN of our Exchange server during configuration, do I enter the public FQDN or the .local FQDN? (mail.domain.com goes to the Barracuda on SMTP port 25, but we have webmail.domain.com open on https port 443 going to OWA). I do not really understand if the FQDN is needed just temporarily during setup from the machine running setup, or if this is a permanent setting that will continue to be used between the Exchange online and the 2016 Exchange server.
2. Once the hybrid configuration is in place, will users be able to see the same mail in both Outlook pointing to Exchange 2016 and in O365 Outlook?
3. Once I am ready to fully move to Exchange 365 and retire the Exchange 2016 server, do I need to install my SSL certs on Exchange 365?
   4. Once mailboxes have been moved and are verified as working, I think I just need to change my MX records to point to the O365 Exchange DNS provided from O365. Am I missing anything else?

Answer 1

1. The Public FQDN that points to the Exchange Servers that will handle the hybrid connections for HTTPs and SMTP. This is a "Permanent" setting. You can't have any SMTP devices between on-prem Exchange and 365 that "modify or process" SMTP traffic.. : https://learn.microsoft.com/en-us/exchange/transport-routing
2. Not sure what you mean here, but users in both locations will see the same Outlook Address Book, and mail will be delivered to the mailboxes depending where the are located (On-Prem or 365)
3. No. You dont have access to any servers like that in 365 and you wouldnt do that anyway. If you are using AADConnect to sync from on-prem to 365, you have to leave at least one Exch Server on-prem for management to be supported. This requirement may change in the future: https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange
4. I would recommend you change the mx record as soon as you can to Office 365, not afterwards. Also make sure all on-prem mail is routed outbound through 365. You will find mail flow is easier to troubleshoot and you can leverage the anti-spam/malware solutions in 365 quicker if you go this route. https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/mail-flow-best-practices

Answer 2

Thanks for the answers, that helps.