Multi tenant Exchange 2019 and Hybrid O365 deployment

Question

Multi tenant Exchange 2019 and Hybrid O365 deployment

David McBride 306

I am looking into doing an O365 Hybrid deployment to our multi-tenant Exchange 2019 so that we can do MFA. Our Exchange tenants are separated by OU, separate GAL, separate name space, and such so that they are completely separate but share the same AD. They have no access to each other in anyway. My question is that if I do a hybrid deployment how will that affect the Exchange org as a whole and per tenant? Will it force user changes for each tenant or can I limit the deployment to only affect specific tenants? Can do hybrid deployment per tenant?
Thanks!!

4 answers

Your answer

Answer 1

Microsoft wants you to keep Exchange on-premise mostly to be sure none of the cloud attributes that route email to and from Office 365 get removed from AD. On paper, they would not help you with support if you got in a bind with your on-premise AD and anything Office 365 / Exchange related as it is not "best practice."
Other options include PowerShell scripts to handle any AD-related functions related to Exchange Online. If you put back an on Premise Exchange, use 2013 / 2016 to run the upgrade to the Schema and prepAD.

Answer 2

David McBride 306

So are you saying that to accomplish 2FA for OWA in On-Prem Exchange I would have to setup ADFS with AAD Connect to Azure AD? Then I could use 2FA with phones?
Thank you for your patience

KyleXu-MSFT 26,396 Reputation points

2021-08-13T08:16:01.387+00:00

ADFS only used for Exchange on-premises, it doesn't related with AAD Connect.

If you want to use phones as 2FA, you need to migrate mailbox to Exchange online or using hybrid.

Answer 3

David McBride 306

Sorry if I am repeating something you already asked but I just need to make sure I have explored all options.
If I enable ADFS and use Azure AD connect to only sync a single OU of users then will only those users in the sync'd OU be required for 2FA and not the users that are not sync'd with Azure AD Connect?
A second possibility I have seen some mention is to create a second virtual directory for OWA that requires 2FA. That way it depend on what URL the users goes to if they need to use 2FA. Will a second OWA virtual directory work?
Thank you for your patience.

KyleXu-MSFT 26,396 Reputation points

2021-08-11T09:12:05.207+00:00

Yes, you could create a second virtual directory for OWA, if users use that OWA will need two-way authentication. A little question about this one: you cannot restrict which OWA the user can access. So, if they know the another OWA, they will could login OWA without two-way authentication.
David McBride 306 Reputation points

2021-08-11T15:35:18.353+00:00

I was reading this article https://learn.microsoft.com/en-us/exchange/clients/outlook-on-the-web/ad-fs-claims-based-auth?view=exchserver-2019 and it seems to indicate I can configure 2FA using ADFS, but does not mention Azure or Azure AD Sync. Does that mean I can accomplish 2FA (mobile phone) with Exchange on-prem for OWA without any kind of sync between Azure AD?
Thank you
KyleXu-MSFT 26,396 Reputation points

2021-08-12T09:28:47.447+00:00

Yes, ADFS could works for an pure Exchange on-premises.

About AAD Connect, it is used to sync AD account to Azure AD, then migrate mailboxes to Exchange online to use Exchange online 2FA.

About using phone as 2FA way is a function for Exchange online. ADFS provides an additional logon page rather than phone for 2FA.

Answer 4

KyleXu-MSFT 26,396

@David McBride

Do you mean that you have multiple Exchange servers coexist in one domain and those Exchange divided by OU. Now, you have an Office 365 want to hybrid with them to use MFA, are you worried about whether it affects Exchange on-premises?

This topology isn't supported, you can double check whether is this your AD topology: Single forest, multiple sync servers to one Azure AD tenant. If your AD in other supported topology, you could deploy hybrid for your Exchange servers, it will not effect the use of Exchange on-premises.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

David McBride 306 Reputation points

2021-07-29T13:08:14.013+00:00

@KyleXu-MSFT
No, there are multiple Exchange servers but it is a DAG cluster. The users are divided by OU to form the separation for each tenant. The Hybrid deployment was a possible solution not something I necessarily are required to do.
The final goal is to be able to use MFA for OWA for just some of the tenants and not have any affect on the tenants that do not want MFA. What solution would you recommend?
Thank you
KyleXu-MSFT 26,396 Reputation points

2021-07-30T09:11:26.49+00:00

If their are in the same AD domain, you will could sync them and create hybrid successfully. You can also enable AAD connect sync for the OU that want to enable MFA. AAD connect could sync AD account based OU. Then you will could enable MFA for those user without effect other users. About detailed information about AAD Connect configuration, you could check from AAD team.
David McBride 306 Reputation points

2021-07-30T13:05:19.127+00:00

Ok, thank you. I can do the AAD already. It is the part to route OWA only for the OU that is being sync'd part that I am not sure about. Some info on that part would be great.
Thank you again.
KyleXu-MSFT 26,396 Reputation points

2021-08-02T06:22:49.63+00:00

Migrate them to Exchange online, you will could enable MFA for them. If you want to keep them on Exchange on-premises, you need to use MFA for them, you could have a look about this article.
David McBride 306 Reputation points

2021-08-02T14:00:37.56+00:00

Thank you for your answer but after doing more research we have decide that Exchange Hybrid deployment will not work for us. We want to use MFA with OWA for our On-Prem Exchange 2019 using Azure AD Connect. I can also do ADFS if needed. I can get the AAD connect working. My problem is that I am not sure what to do after that to get web browsers accessing OWA to utilize MFA. Some direction would be great.
Thank you
KyleXu-MSFT 26,396 Reputation points

2021-08-03T08:24:06.9+00:00
For Exchange on-premises, you could use ADFS as Multi-Factor Authentication. You cannot redirect the request to Exchange online although the mailbox is synchronized to AAD.

They two different ways for mailbox hosted on Exchange online and Exchange on-premises, those two articles may be helpful to you:

Use AD FS claims-based authentication with Outlook on the web

Set up your Microsoft 365 sign-in for multi-factor authentication

It decided by where your mailbox hosted.
David McBride 306 Reputation points

2021-08-03T13:28:26.233+00:00

@KyleXu-MSFT
Thank you for the information. I am still unclear on the user experience. So when the users browses to http://mydomain.com/owa do they get redirected to an Office 365 login prompt? Do they have to put their credentials in for the OWA window and Office 365? How does this look for the user?
Also, in the AD FS setup process is there a way to only allow specific AD groups to use the claims process? If so, does that mean that some users will be required to use MFA and some users will not be required to use MFA?
Thank you
KyleXu-MSFT 26,396 Reputation points

2021-08-05T08:43:55.72+00:00

Exchange on-premises OWA cannot redirect to Exchange online OWA, for Exchange on-premises mailbox, you could enable ADFS for them, they will get two-way authentication before access mailbox from OWA. It will works on all mailboxes.

For Exchange online mailbox, they could use MFA(supported phone authentication) as two-way authentication.
David McBride 306 Reputation points

2021-08-05T12:51:48.967+00:00

@KyleXu-MSFT
Thank you for the replay. That still does not explain how it looks for the users experience. Can you please look at my above question again?
Thanks
KyleXu-MSFT 26,396 Reputation points

2021-08-06T02:08:02.207+00:00

You need to know the working mechanism of ADFS and MFA first, so, I double introduce them to you. You cannot redirect Exchange on-premises OWA to Exchange online OWA. For Exchange on-premises mailbox, you need use ADFS for two-way authentication, it will effect all Exchange on-premises mailbox.

If you want to only enable two-way authentication on part of mailboxes, you need to migrate them to Exchange online, then enable MFA for them.
KyleXu-MSFT 26,396 Reputation points

2021-08-09T08:08:51.767+00:00

Any update about this thread now? If you still have doubt about Multi-Factor Authentication, I will introduce it to you.

Share via

Multi tenant Exchange 2019 and Hybrid O365 deployment

4 answers

Your answer