Office 365 hybrid deployment

steh88 31

Looking for some pointers if someone can help and point me on the right path. We are in the process of migrating to Office 365 using a hybrid deployment, something I have never done before so looking for a few pointers and to see if my thought process is correct.

We currently have an environment consisting of 4 exchange 2016 servers with all inbound/outbound mail going through a secure mail gateway. When we migrate we are going to have a mixture of mailboxes within Office 365 and on prem.

So in terms of mail flow I am assuming it will be www>mail gateway>Exchange >Office 365.

Were my confusion lies is with the connectors both within Office 365 and Exchange.

My thought process is this:

Office 365
Mail flow connector>From Office365 to Your organisation Email server.
Use the connector only when have a transport rule that redirects messages
Route email messages using MX record (As this currently points at mail gateway)

Mail flow connector>From Your organisation Email server to Office 365
Verify via external IP of email server

Create mail flow rule to redirect emails via the connector

On Prem Exchange
Keep connectors as they are as currently set to go through mail gateway

Is there a connector that needs to be configured within exchange to then send emails to Office 365 or does the hybrid config wizard configure this.

1 answer

Joyce Shen - MSFT 16,676 Reputation points

2022-03-23T02:04:06.307+00:00

Hi @steh88

HCW will help you create send/receiver connectors automatically which could make sure the mail flow between Exchange on-premises and Exchange online. After that, if you want to add third-party mail gateway, you could create send connector for it manually.

The official document here introduces the connectors in detail: Set up connectors to route mail between Microsoft 365 or Office 365 and your own email servers

And how the hybrid mailflow works: Transport routing in Exchange hybrid deployments
Please note that: Don't place any servers, services, or devices between your on-premises Exchange servers and Microsoft 365 or Office 365 that process or modify SMTP traffic.

Below related links will be helpful to you as well:
1.Mail flow best practices for Exchange Online, Microsoft 365, and Office 365 (overview)
2.Hybrid Exchange and third-party SMTP mail gateway

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
steh88 31 Reputation points

2022-03-23T10:22:32.967+00:00

All that information is a big help thank you.

In terms of mail flow then I have read that if you go www>Exchange >Office 365 you lose the ability for DLP, EOP etc is this the case. I have assumed that because the email is being sent from exchange to Office 365 and still hitting Office 365 the email would still be scanned by EOP etc or is this not the case.

So if we were to go www>mail gateway>O365>Exchange we would be adding a double layer of protection in a sense as mail would be scanned by both our mail gateway and Office 365, have I got this correct?

Joyce Shen - MSFT 16,676 Reputation points

2022-03-24T02:30:22.6+00:00

Hi @steh88

EOP works for mails sent from on-prem Exchange server to O365 as well.

And yes, a double anti-spam check will work for this scenario.

steh88 31 Reputation points

2022-03-24T15:01:18.493+00:00

So in terms of connectors then if I want to go www>smart host>exchange>Office 365 would it be

Office 365 connectors
Mail flow connector>From Office365 to Your organisation Email server.
Use the connector only when have a transport rule that redirects messages
Route email messages using MX record (As this currently points at mail gateway)

Mail flow connector>From Your organisation Email server to Office 365
Verify via external IP of email server
Create mail flow rule to redirect emails via the connector

On Prem Exchange connectors
Keep connectors as they are as currently set to go through mail gateway

Joyce Shen - MSFT 16,676 Reputation points

2022-03-25T07:28:02.72+00:00

Hi,

This can be achieved, and the most important: you will need to make sure no connectors are configured which may lead to the mailflow between your on-prem server and o365 will go pass your gateway.

steh88 31 Reputation points

2022-03-25T20:12:55.647+00:00

So do you mean only have one connector going through the mail gateway? i.e connector in office 365 going through the gateway and not a connector on prem within exchange?

Joyce Shen - MSFT 16,676 Reputation points

2022-03-29T06:45:02.453+00:00

Hi,

Could you please confirm which scenario you really want to deploy, the suggested way should be like www>mail gateway>O365>Exchange you mentioned above.

steh88 31 Reputation points

2022-03-29T08:51:40.837+00:00

Hi,

The thought process for www>mail gateway>Exchange>O365 was because we are going to have a number of mailboxes remain on prem, but there is no preference for either scenario. Why is www>mail gateway>O365>Exchange the recommended method out of curiosity?

The below mail flow connectors within office 365 would this push it through gateway>O365>Exchange
Office 365 connectors
Mail flow connector>From Office365 to Your organisation Email server.
Use the connector only when have a transport rule that redirects messages
Route email messages using MX record (As this currently points at mail gateway)

Mail flow connector>From Your organisation Email server to Office 365
Verify via external IP of email server
Create mail flow rule to redirect emails via the connector

Joyce Shen - MSFT 16,676 Reputation points

2022-04-01T06:03:30.703+00:00

Hi,

Yes, for the process: www>mail gateway>Exchange>O365

One connector used to route your inbound mailflow, Internet-> gateway -> Exchange server on premise

And the mail flow between Exchange Online and on-premises should use the connectors created by HCW.

steh88 31 Reputation points

2022-04-01T11:46:41.34+00:00

Would the connectors for that be
Office 365 connectors
Mail flow connector>From Office365 to Your organisation Email server.
Use the connector only when have a transport rule that redirects messages
Route email messages using MX record (As this currently points at mail gateway)

Mail flow connector>From Your organisation Email server to Office 365
Verify via external IP of email server
Create mail flow rule to redirect emails via the connector

Does that sound right

Joyce Shen - MSFT 16,676 Reputation points

2022-04-06T06:44:23.76+00:00

Hi,

Seems to be no issue.

JanakKhadka 566 Reputation points

2022-05-24T04:56:28.787+00:00

Agreed and very well explained.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Office 365 hybrid deployment

1 answer

Your answer