OoO in hybrid mode, M365 mailbox attaching external OoO to Internal, and vice versa.

Bill Tkach 86 Reputation points
2022-04-14T23:38:45.997+00:00

We are running Exchange 2016.22 in Hybrid mode.

Bill's account is in ExO.
Kevin's is on-premise.

If Bill turns on his OoO, and Kevin sends him a message, Kevin receives the EXTERNAL OoO message, not the Internal.
Works the same the other way, ie if Kevin sends to Bill.

On the on-premise mailboxes, it all works fine as well.
In the ExO, it all work fine.

Not sure what is up.

When I look at the special header line, it is signed "Internal".

X-MS-Exchange-CrossTenant-AuthAs: Internal

I'm not sure why this is working this way.

Here's a header, in case that provides any insight:

Received: from YQBPR0101MB5941.CANPRD01.PROD.OUTLOOK.COM
(2603:10b6:c01:34::20) by YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM with HTTPS;
Thu, 14 Apr 2022 23:16:17 +0000
Received: from YT1PR01CA0108.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:2c::17)
by YQBPR0101MB5941.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:34::20) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5164.20; Thu, 14 Apr
2022 23:16:16 +0000
Received: from YT3CAN01FT012.eop-CAN01.prod.protection.outlook.com
(2603:10b6:b01:2c:cafe::3e) by YT1PR01CA0108.outlook.office365.com
(2603:10b6:b01:2c::17) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5164.20 via Frontend
Transport; Thu, 14 Apr 2022 23:16:16 +0000
Authentication-Results: spf=none (sender IP is 208.98.204.234)
smtp.helo=mail.parksville.ca; dkim=none (message not signed)
header.d=none;dmarc=fail action=none header.from=parksville.ca;
Received-SPF: None (protection.outlook.com: mail.parksville.ca does not
designate permitted sender hosts)
Received: from mail.parksville.ca (208.98.204.234) by
YT3CAN01FT012.mail.protection.outlook.com (10.118.140.122) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id
15.20.5164.19 via Frontend Transport; Thu, 14 Apr 2022 23:16:15 +0000
Received: from COP-MAIL.city.parksville.bc.ca (192.168.2.31) by
COP-MAIL.city.parksville.bc.ca (192.168.2.31) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.1.2375.18; Thu, 14 Apr 2022 16:16:14 -0700
Received: from COP-MAIL.city.parksville.bc.ca ([::1]) by
COP-MAIL.city.parksville.bc.ca ([fe80::1cb3:baaa:502f:e73%12]) with Microsoft
SMTP Server id 15.01.2375.018; Thu, 14 Apr 2022 16:16:14 -0700
Content-Type: multipart/mixed;
boundary="_000_8de3e6e463df4e3392f7f42c63c58d02COPMAILcityparksvillebc_"
From: Deanne Dieleman <DDieleman@parksville.ca>
To: Bill Tkach <BTkach@parksville.ca>
Subject: Automatic reply: Cisco Renewals
Thread-Topic: Cisco Renewals
Thread-Index: AQHYUE8o/ZS8Do9uiUWH8Sdwu/kep6zv/qOAgAAKQkCAAAGiMIAAACCH
Date: Thu, 14 Apr 2022 23:16:14 +0000
Message-ID: <8de3e6e463df4e3392f7f42c63c58d02@COP-MAIL.city.parksville.bc.ca>
References: <UMwg1000000000000000000000000000000000000000000000RACP5K00QZBpri2PRVWntjncOxJZwg@sfdc.net>
<YQXPR01MB664070A0EA13CB9A7C4DF4BAC0EF9@YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM>
<c7c99a0ca0404b3ea8aa7a3cf949045e@parksville.ca>,<YQXPR01MB6640B32DED1FF89689F3AFC8C0EF9@YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM>
In-Reply-To: <YQXPR01MB6640B32DED1FF89689F3AFC8C0EF9@YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM>
X-MS-Has-Attach:
X-Auto-Response-Suppress: All
X-MS-Exchange-Inbox-Rules-Loop: DDieleman@parksville.ca
X-MS-TNEF-Correlator: <8de3e6e463df4e3392f7f42c63c58d02@COP-MAIL.city.parksville.bc.ca>
x-ms-exchange-parent-message-id: <YQXPR01MB6640B32DED1FF89689F3AFC8C0EF9@YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM>
auto-submitted: auto-generated
x-ms-exchange-generated-message-source: Mailbox Rules Agent
x-exclaimer-md-config: 656574dc-420f-48ad-8927-61c710e7c5a6
MIME-Version: 1.0
X-OrganizationHeadersPreserved: COP-MAIL.city.parksville.bc.ca
Return-Path: <>
X-MS-Exchange-Organization-ExpirationStartTime: 14 Apr 2022 23:16:16.5732
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
e58f3b72-7e96-4965-17a4-08da1e6cc6ba
X-EOPAttributedMessage: 0
X-MS-Exchange-Organization-MessageDirectionality: Originating
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 03
X-MS-Exchange-Organization-AuthSource: COP-MAIL.city.parksville.bc.ca
X-MS-Exchange-Organization-SCL: -1
X-CrossPremisesHeadersPromoted:
YT3CAN01FT012.eop-CAN01.prod.protection.outlook.com
X-CrossPremisesHeadersFiltered:
YT3CAN01FT012.eop-CAN01.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-OriginatorOrg: parksville.ca
X-MS-Office365-Filtering-Correlation-Id: e58f3b72-7e96-4965-17a4-08da1e6cc6ba
X-MS-TrafficTypeDiagnostic: YQBPR0101MB5941:EE_
X-ExclaimerHostedSignatures-MessageProcessed: true
X-Microsoft-Antispam: BCL:0;
X-Forefront-Antispam-Report:
CIP:208.98.204.234;CTRY:CA;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKI;H:mail.parksville.ca;PTR:InfoDomainNonexistent;CAT:NONE;SFS:;DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Apr 2022 23:16:15.8389
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: e58f3b72-7e96-4965-17a4-08da1e6cc6ba
X-MS-Exchange-CrossTenant-Id: c97f1f64-f227-400b-8e81-832107adcac2
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=c97f1f64-f227-400b-8e81-832107adcac2;Ip=[208.98.204.234];Helo=[mail.parksville.ca]
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: COP-MAIL.city.parksville.bc.ca
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YQBPR0101MB5941
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.3965669
X-MS-Exchange-Processed-By-BccFoldering: 15.20.5164.020
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506458)(944626604)(920097)(425001)(930097);
X-Microsoft-Antispam-Message-Info:
MMc+XFAI93Hu4/Ib4CzXDvVjAV5LWeoX01usE87uwQ6YmRZFy7C6+ULbA47Six7Z3dMtaFfgsi7Tu/oQObZuFBTrxYNc+GW949SS+UgmohoCD7bBj5+sQX83PvJCC01k42Q0V7+5jjAy7XbcD1zmXuWixb0XJwa6eDp16wTS5dwZvbOjff5cPrq90U/BN19YtnmwcPfeYFBiE1eAQWOYqSNTNdrOSuRzFYidcyyqmilYuezr4bYGAjZvoXWqJCdr5SqFaXSwWHL3jH06fmHMODcmI1ljuCYn0d+uIQXg19EL8ZUE0Cdw10SLCD+vNncNGzANCYJ5GVAF5vvRzit71x9GjP+UChNk9wPasuVphLPm2R0hIru5/izX5Z3XlwoU8q8OQz94utb1cSGXV/2BtDAcAj3GD5DsnfXYJhNpahbTs4QFSFD23MIj8TxMXWIAkQ+Uq0U2xvBnbIWAf5JpMoqcjzMDfogYLSW+SaNCj6cYqemxMCj3/HQ++3tG6vrNbkYbq4ew3pqbeduvfrtwopmy8oRwV9eDgtH+S10tyoUXkeaYOPAzY6TmtdNvByvdHqZNTan29kU5OUuiFhdLPfYeSGVH2gch4EBeCCdDYMDcW6XgOSyC3RRyVi2/I2B+

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,319 questions
Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
1,960 questions
{count} votes

Accepted answer
  1. KyleXu-MSFT 26,226 Reputation points
    2022-04-15T05:17:39.547+00:00

    @Bill Tkach

    I tested it in my lab and got the same result.

    After my research, this is related with remote domain configuration on Exchange on-premises.

    You could use the command below to check remote domain on your Exchange on-premises:

    Get-RemoteDomain  
    

    Then set hybrid domain as Internal:
    193288-qa-kyle-13-11-23.png

    In this way, when Exchange online sends emails to Exchange on-premises mailboxes, Exchange on-premises mailboxes will return the internal OOF.
    193268-qa-kyle-13-15-04.png

    Note that enabling OOF will only trigger once for the same user. You need to disable OOF and enable it again. Otherwise, this user will not receive OOF.


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful