Cloud-based management of Exchange attributes for Remote Mailboxes in hybrid environments

Overview

In an Exchange Hybrid environment, the management of Exchange attributes for directory-synchronized users is restricted in Exchange Online (EXO). Organizations are required to utilize their on-premises Exchange Server, sometimes referred as Last Exchange Server (LES), to modify these attributes within Active Directory (AD), synchronizing any changes to the cloud through Cloud Sync or Connect Sync. As a result, although mailboxes are located in the cloud, organizations remain dependent on their on-premises Exchange Server for managing cloud mailboxes by executing Exchange Server cmdlets that update on-premises Active Directory, which then synchronizes the updates to the cloud.

A new capability in Exchange Online now allows administrators to manage Exchange attributes for directory-synchronized users with mailboxes hosted in the cloud. With this update, the Source of Authority (SOA) for Exchange-specific attributes can be transferred to the cloud, while the SOA for identity-related attributes remains under the control of the on-premises Active Directory. After moving the SOA for Exchange attributes to the cloud, these details can be managed using EXO PowerShell, the Microsoft 365 Admin Center, or the Exchange Admin Center, whereas identity attributes are still modified through on-premises Active Directory only. This document provides detailed instructions for activating this feature for users whose mailboxes are located in the cloud, as well as the process of shifting the SOA for Exchange attributes to the cloud environment.

After a user's Exchange attribute SOA is transferred to the cloud, editing the user's first name and last name requires using on-premises Active Directory. To modify Exchange attributes such as HiddenFromAddressListsEnabled or CustomAttribute(x), administrators need to use Exchange Online PowerShell or Microsoft 365 Exchange Admin Center (EAC).

Modifications to designated Exchange attributes can also be written back to on-premises Active Directory through Microsoft Entra Cloud Sync. For configuration details, see How to enable Exchange attribute writeback.

Feature Availability

Microsoft is providing this feature in two phases:

Phase 1 (now GA) introduces per-mailbox control for cloud management of Exchange attributes. Administrators can opt in individual mailboxes for cloud management by setting IsExchangeCloudManaged to true. During this phase, mailboxes may also be rolled back to on-premises management if required (IsExchangeCloudManaged set back to false). Phase 1 is intended for managing existing user mailbox attributes individually and for feature validation. Support is available in Commercial (Global) tenants, as well as in GCCH, DoD, and Gallatin environments.

Phase 2 (Public Preview) introduces writeback support for designated attributes through Microsoft Entra Cloud Sync integration. Modifications to designated Exchange properties made in the cloud are automatically synchronized back to on-premises Active Directory; for instance, changes to a proxy address in Exchange Online are reflected on-premises. Writeback requires Microsoft Entra Cloud Sync. During Public Preview, writeback supports tenants with fewer than 200,000 cloud-managed mailboxes; this limit increases at general availability, targeted for the end of June 2026. For configuration details, see How to enable Exchange attribute writeback.

Object‑level Source of Authority (SOA) management enables organizations to transition individual directory objects from on‑premises management to cloud management as part of decommissioning on‑premises Exchange Servers and Active Directory. Managing the SOA for Users, Groups and Contacts is now generally available (GA). To use this functionality, follow the steps outlined in Configure user Source of Authority, Configure Group Source of Authority and Configure Contact SOA.

Identity, Exchange Attributes and Writeback

The following section contains a comprehensive table detailing which attributes can be edited following the Exchange Attribute SOA transfer and whether these updates will be written back to the on-premises Active Directory after the SOA transfer. It shows the intended final state of the feature and might not reflect behavior in current releases.

No.	Attribute	Type	Can be edited in EXO	Writeback to On-prem	Cmdlet to modify	Parameter
1	accountEnabled	Identity	No
2	C	Identity	No
3	Cn	Identity	No
4	Co	Identity	No
5	company	Identity	No
6	countryCode	Identity	No
7	department	Identity	No
8	displayName	Identity	No
9	facsimiletelephonenumber	Identity	No
10	givenName	Identity	No
11	homePhone	Identity	No
12	info	Identity	No
13	Initials	Identity	No
14	l	Identity	No
15	mailNickname	Identity	No
16	manager	Identity	No
17	mobile	Identity	No
18	msDS-HABSeniorityIndex	Identity	No
19	msDS-PhoneticDisplayName	Identity	No
20	objectSID	Identity	No
21	otherFacsimileTelephone	Identity	No
22	otherHomePhone	Identity	No
23	otherTelephone	Identity	No
24	pager	Identity	No
25	physicalDeliveryOfficeName	Identity	No
26	postalCode	Identity	No
27	pwdLastSet	Identity	No
28	sn	Identity	No
29	sourceAnchor	Identity	No
30	st	Identity	No
31	streetAddress	Identity	No
32	telephoneAssistant	Identity	No
33	telephoneNumber	Identity	No
34	title	Identity	No
35	usageLocation	Identity	No
36	userPrincipalName	Identity	No
37	wWWHomePage	Identity	No
38	altRecipient	Exchange	Yes	No	Set-Mailbox	ForwardingAddress
39	authoring	Exchange	Yes	No	Set-Mailbox	AcceptMessagesOnlyFrom
40	dLMemRejectPerms	Exchange	Yes	No	Set-Mailbox	RejectMessagesFromDLMembers
41	dLMemSubmitPerms	Exchange	Yes	No	Set-Mailbox	AcceptMessagesOnlyFromDLMembers
42	extensionAttribute1	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute1
43	extensionAttribute10	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute10
44	extensionAttribute11	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute11
45	extensionAttribute12	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute12
46	extensionAttribute13	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute13
47	extensionAttribute14	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute14
48	extensionAttribute15	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute15
49	extensionAttribute2	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute2
50	extensionAttribute3	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute3
51	extensionAttribute4	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute4
52	extensionAttribute5	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute5
53	extensionAttribute6	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute6
54	extensionAttribute7	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute7
55	extensionAttribute8	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute8
56	extensionAttribute9	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute9
57	legacyExchangeDN	Exchange	Yes	No	Not editable in cloud by default.
58	mail	Exchange	Yes	No	Set-Mailbox	WindowsEmailAddress
59	msExchArchiveGUID	Exchange	Yes	No	Enable-Mailbox	Archive
60	msExchArchiveName	Exchange	Yes	No	Set-Mailbox	ArchiveName
61	msExchAssistantName	Exchange	Yes	No	Set-User	AssistantName
62	msExchAuditAdmin	Exchange	Yes	No	Set-Mailbox	AuditAdmin
63	msExchAuditDelegate	Exchange	Yes	No	Set-Mailbox	AuditDelegate
64	msExchAuditDelegateAdmin	Exchange	Yes	No	Set-Mailbox	AuditDelegate
65	msExchAuditOwner	Exchange	Yes	No	Set-Mailbox	AuditOwner
66	msExchBlockedSendersHash	Exchange	Yes	No	Set-MailboxJunkEmailConfiguration	BlockedSendersAndDomains
67	msExchBypassAudit	Exchange	Yes	No	Set-MailboxAuditBypassAssociation	AuditBypassEnabled
68	msExchDelegateListLink	Exchange	Yes	No	Add-MailboxPermission	AccessRights, User, InheritanceType
69	msExchELCExpirySuspensionEnd	Exchange	Yes	No	Set-Mailbox	EndDateForRetentionHold
70	msExchELCExpirySuspensionStart	Exchange	Yes	No	Set-Mailbox	StartDateForRetentionHold
71	msExchELCMailboxFlags	Exchange	Yes	No	Set-Mailbox	SingleItemRecoveryEnabled, LitigationHoldEnabled, RetentionHoldEnabled,
72	msExchEnableModeration	Exchange	Yes	No	Set-Mailbox	ModerationEnabled
73	msExchExtensionCustomAttribute1	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute1
74	msExchExtensionCustomAttribute2	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute2
75	msExchExtensionCustomAttribute3	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute3
76	msExchExtensionCustomAttribute4	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute4
77	msExchExtensionCustomAttribute5	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute5
78	msExchHideFromAddressLists	Exchange	Yes	No	Set-Mailbox	HiddenFromAddressListsEnabled
79	msExchImmutableID	Exchange	Yes	No	Set-Mailbox	ImmutableId
80	msExchLitigationHoldDate	Exchange	Yes	No	Set-Mailbox	LitigationHoldDate
81	msExchLitigationHoldOwner	Exchange	Yes	No	Set-Mailbox	LitigationHoldOwner
82	msExchMailboxAuditEnable	Exchange	Yes	No	Set-Mailbox	AuditEnabled
83	msExchMailboxAuditLogAgeLimit	Exchange	Yes	No	Set-Mailbox	AuditLogAgeLimit
84	msExchMailboxGuid	Exchange	Yes	No	Not editable in cloud by default.
85	msExchModeratedByLink	Exchange	Yes	No	Set-Mailbox	ModeratedBy
86	msExchModerationFlags	Exchange	Yes	No	Set-Mailbox	SendModerationNotifications, ByPassModerationFromSendersOrMembers, ModerationEnabled
87	msExchRecipientDisplayType	Exchange	Yes	Yes	Set-Mailbox	Type
88	msExchRecipientTypeDetails	Exchange	Yes	Yes	Set-Mailbox	Type
89	msExchRemoteRecipientType	Exchange	Yes	No	Set-Mailbox	RemoteRecipientType
90	msExchRequireAuthToSendTo	Exchange	Yes	No	Set-Mailbox	RequireAllSendersAreAuthenticated
91	msExchResourceCapacity	Exchange	Yes	No	Set-Mailbox	ResourceCapacity
92	msExchResourceDisplay	Exchange	Yes	No	Set-Mailbox	ResourceCustom
93	msExchResourceMetaData	Exchange	Yes	No	Set-Mailbox	ResourceCustom
94	msExchResourceSearchProperties	Exchange	Yes	No	Set-Mailbox	ResourceCustom
95	msExchRetentionComment	Exchange	Yes	No	Set-Mailbox	RetentionComment
96	msExchRetentionURL	Exchange	Yes	No	Set-Mailbox	RetentionUrl
97	msExchSafeRecipientsHash	Exchange	Yes	No	Set-MailboxJunkEmailConfiguration	Reserved for internal use
98	msExchSafeSendersHash	Exchange	Yes	No	Set-MailboxJunkEmailConfiguration	TrustedSendersAndDomains
99	msExchSenderHintTranslations	Exchange	Yes	No	Set-Mailbox	MailTipTranslations
100	msExchUserHoldPolicies	Exchange	Yes	No	Set-Mailbox	LitigationHoldEnabled
101	proxyAddresses	Exchange	Yes	Yes	Set-Mailbox	EmailAddresses and WindowsEmailAddress
102	publicDelegates	Exchange	Yes	No	Set-Mailbox	GrantSendOnBehalfTo
103	unauthOrig	Exchange	Yes	No	Set-Mailbox	RejectMessagesFrom
104	userCertificate	Exchange	Yes	No	Set-Mailbox	UserCertificate
105	userSMIMECertificates	Exchange	Yes	No	Set-Mailbox	UserSMimeCertificate

Prerequisites

Before transferring the SOA from on-premises to Exchange Online, certain prerequisites must be met.

Microsoft Entra Connect

To enable this feature, install the latest version of Entra Connect Sync. Download and install version 2.5.190.0 or higher of the Entra Connect Sync build prior to use. For detailed instructions on upgrading from older versions, refer to the Microsoft Entra Connect: Upgrade from a previous version to the latest documentation. If you use an older version of Entra Connect Sync than 2.5.190.0, the sync client will try to push Exchange attributes of already SOA transferred mailboxes to Entra ID but will fail. Upgrading to newer version will resolve this issue.

To confirm successful installation of the Entra Connect Sync build, navigate to Programs within the Control Panel and verify that the Microsoft Entra Connect Sync version is 2.5.190.0 or higher. Alternatively, this information may be obtained using PowerShell:

(Get-ADSyncGlobalSettings).Parameters['Microsoft.Synchronize.ServerConfigurationVersion']

Microsoft Entra Cloud Sync

In addition to Microsoft Entra Connect, this feature is now supported through Microsoft Entra Cloud Sync.

Important

To enable Exchange attribute writeback (Phase 2), installation and configuration of Microsoft Entra Cloud Sync is mandatory. Organizations that already use Microsoft Entra Connect Sync are not required to uninstall or replace it. Cloud Sync is installed in addition to Connect Sync. The two coexist side by side. Connect Sync continues to handle your directory synchronization exactly as before, while Cloud Sync handles only the Exchange attribute writeback. There is no impact to your existing mailboxes, users, or sync configuration.

To download and install the Cloud Sync provisioning agent, follow Install the Microsoft Entra provisioning agent.

After installation, confirm:

• Version (on the local server): The agent is 1.1.1107.0 or later, which is required for Exchange attribute writeback. Navigate to C:\Program Files\Microsoft Azure AD Connect Provisioning Agent, right-click AADConnectProvisioningAgent.exe, then select Properties > Details.
• Registration (in the Microsoft Entra admin center): The agent appears with status Active under Microsoft Entra admin center > Identity > Hybrid management > Microsoft Entra Connect > Cloud Sync > Agents.

Role requirements

To successfully manage the IsExchangeCloudManaged property, your account needs to belong to one of the following built-in roles, which are designed to provide the appropriate administrative rights:

• (Recommended) Exchange Administrator or
• Hybrid Identity Administrator or
• Global Administrator

How to transfer Exchange attributes SOA to the cloud

A new parameter, IsExchangeCloudManaged, has been added for Exchange Online users. This property indicates whether a directory-synchronized user's Exchange attributes are managed in the cloud or on-premises. By default, the IsExchangeCloudManaged value is set to false. Note that this parameter is applicable only to mailboxes with a user whose IsDirSynced status is true. It should not be used together with any other parameters.

Important

After updating dir-synced users' mailbox attributes on-premises with Set-RemoteMailbox, allow for the usual Connect Sync or Cloud Sync cycle plus 24 hours before switching Exchange attributes to Cloud Managed. For example, if your sync takes 6 hours, wait 30 hours in total.

To configure Exchange attributes for a directory-synchronized user's mailbox to be managed in the cloud, change the user's parameter value to true. To accomplish this, open an Exchange Online PowerShell session and execute the following command for a mailbox that is located in the cloud.

Set-Mailbox -Identity <User> -IsExchangeCloudManaged $true

The status of this change can be verified by executing the following cmdlet:

Get-Mailbox -Identity <User> | Format-List Identity, IsExchangeCloudManaged

When IsExchangeCloudManaged is set to true for a mailbox synced via Entra Connect Sync, Exchange Attributes stop updating from on-premises. You can then edit these attributes directly in the cloud, which was previously restricted.

Set-Mailbox -Identity <User> -CustomAttribute1 "ModifiedInTheCloud"

To find all users whose Exchange attribute SOA has been transferred to the cloud, retrieve the accounts where the IsExchangeCloudManaged property is set to true. You can use the following command:

Get-Mailbox | Where-Object { $_.IsDirSynced -eq $true -and $_.IsExchangeCloudManaged -eq $true }

How to enable Exchange attribute writeback

After transferring the Exchange attribute SOA to the cloud, configure Microsoft Entra Cloud Sync to write back supported Exchange attributes to on-premises Active Directory. The configuration is performed in the Microsoft Entra admin center and requires the Hybrid Identity Administrator role.

Note

Before proceeding, ensure that the Cloud Sync provisioning agent is installed and verified, as described in Microsoft Entra Cloud Sync.

Create the synchronization configuration

1. Sign in to the Microsoft Entra admin center.

2. On the left pane, scroll down to Entra Connect, expand it, and select Cloud Sync.

   

3. On the Cloud sync | Configurations page, select the New configuration dropdown, and then select EXO to AD attribute sync (Preview).

   

4. On the New Exchange Online Attribute Writeback configuration page, verify that the agent matches the domain you want to configure sync for, and then select Create. Job creation might take a few minutes.

   

5. After the job is created, the Overview page for the new configuration opens automatically. To return to this page later, select the configuration name on the Cloud sync | Configurations page.

   

Start the synchronization job

On the Overview tab, select Start provisioning, and then select Yes to confirm.

Note

Allow a few minutes for the initial sync cycle to begin.

Manage the synchronization job

The job's status appears in the Status column on the Cloud sync | Configurations page. Selecting the link in that column opens a sidebar with additional details. Opening the configuration provides further insights on the Overview tab, including:

• Provisioning logs: View individual sync operations from the left menu.
• Audit logs: View configuration changes from the left menu.

To pause the job, select Pause provisioning on the Overview tab.

To delete the job, select Delete configuration on the Overview tab. This action leaves the configuration without a job inside. To delete the entire configuration, select the ... menu for the configuration on the Cloud sync | Configurations page, and then select Delete configuration.

To view or edit attribute mappings or scoping, open the configuration and select the Attribute Mappings or Scoping filters tab.

Provision on demand

To trigger an immediate sync for a specific user instead of waiting for the next sync cycle, use Provision on demand.

1. From the configuration's left menu, select Provision on demand.

   

2. Search for the user or group, and then select Provision.

   

3. After the provisioning request completes, the result is displayed.

   

Verify writeback is working

After the synchronization job is running, verify writeback for an existing cloud-managed mailbox:

1. In Exchange Online PowerShell, modify a writeback-enabled attribute on the mailbox:

   Set-Mailbox -Identity <User> -CustomAttribute1 "TestValue_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
   

2. Wait for the next sync cycle (approximately 20 minutes), or use Provision on demand for an immediate sync.

3. In on-premises Exchange Management Shell, confirm that the value reached on-premises Active Directory:

   Get-RemoteMailbox -Identity <User> | Format-List CustomAttribute1
   

   The value should match the value set in Exchange Online.

How to transfer Exchange attributes SOA back to on-premises

To change the management of a user's Exchange attributes from cloud-managed to on-premises-managed, set IsExchangeCloudManaged to false. After this setting is updated, the next synchronization cycle will update the user's cloud Exchange attributes with the values from the on-premises environment.

Prior to implementing this change, ensure that any modifications made in the Cloud which must be retained in the on-premises Active Directory are properly backed up. Utilize cmdlets such as Get-Mailbox and Get-User to save relevant values, allowing for manual restoration to the on-premises environment when required.

The following command transfers the SOA for a mailbox back to on-premises-managed:

Set-Mailbox -Identity <User> -IsExchangeCloudManaged $false

How to create new mailboxes

Note

This section describes the workflow when tenant-wide SOA is not enabled.

New mailboxes may continue to be created using the on-premises New-RemoteMailbox cmdlet, which provisions mailboxes in the cloud, until the final Exchange Server is decommissioned or shut down. However, as the objective of this feature is to accelerate the decommissioning process for the last Exchange Server, the recommended approach for creating new mailboxes is outlined here:

1. Create an Active Directory user in the on-premises environment and assign the required identity attributes. If a custom source anchor is used, ensure the property is assigned in the on-premises Active Directory.
2. Entra Connect Sync will then synchronize the identity to the cloud.
3. Use the Microsoft 365 Admin Center to assign an Exchange Online license to the user. This action provisions a mailbox in Exchange Online.
4. Finally, use Set-Mailbox to set IsExchangeCloudManaged to true. This transfers the SOA for this user to the cloud.

How to delete an existing mailbox

To delete a user and their mailbox, the process requires removing the user from on-premises Active Directory, even if the attributes are managed in the cloud. When the deletion is synchronized to the cloud through Entra Connect Sync, the user's mailbox is also deleted from the cloud.

How to enable the feature at a tenant level

It's also possible to enable this feature at the tenant level. Tenant-wide SOA was introduced to streamline the configuration process by setting IsExchangeCloudManaged to true by default for newly created mailboxes. This behavior simplifies mailbox management in the cloud by removing the dependency on an on-premises Exchange Server. Note that this doesn't affect mailboxes that were already migrated to Exchange Online. To enable cloud management for these mailboxes, follow the steps outlined in How to transfer Exchange attributes SOA to the cloud.

Warning

We don't recommend enabling this feature while you continue to host and manage mailboxes on an on‑premises Exchange Server. As explained in the following section, newly created on‑premises mailboxes don't appear in the Global Address List (GAL) in Exchange Online when this feature is enabled.

When tenant-wide SOA is enabled, user accounts associated with newly created mailboxes are synchronized to Microsoft Entra ID without Exchange-related attributes. To provision these users with cloud mailboxes, an appropriate Exchange Online plan must be assigned. After the mailbox is provisioned, it is managed in the cloud by default, eliminating the need to explicitly opt in each mailbox, as described in How to transfer Exchange attributes SOA to the cloud.

Ensure that one of the following roles is assigned:

• Hybrid Identity Administrator or
• Global Administrator

Also, ensure that you are using a supported version of Microsoft Entra Connect, as described in the Prerequisites section. Microsoft Entra Cloud Sync also supports this feature.

To enable this feature, Connect to Exchange Online, and then run the following command:

Set-OrganizationConfig -ExchangeAttributesCloudManagedByDefault

To confirm that the feature is enabled, run the following command:

Get-OrganizationConfig | Format-List BlockExchangeProvisioningFromOnPremEnabled

The following output is displayed: BlockExchangeProvisioningFromOnPremEnabled : True

To disable the feature, run the following command. Note that this change does not affect users that were created in Exchange Server and synchronized to the cloud while the feature was enabled:

Set-OrganizationConfig -ExchangeAttributesServerManagedByDefault

To confirm that the feature is disabled, run the following command:

Get-OrganizationConfig | Format-List BlockExchangeProvisioningFromOnPremEnabled

The following output is displayed: BlockExchangeProvisioningFromOnPremEnabled : False

Frequently Asked Questions

❓ What will happen if I try to offboard (migrate) user's mailbox to on-premises while IsExchangeCloudManaged is true?

To offboard a mailbox from the cloud, set IsExchangeCloudManaged to false before migration. Offboarding when this attribute is true will break synchronization between on-premises Active Directory and Entra, because Exchange attributes will be treated as cloud-managed, blocking updates from on-premises.

❓ I use an IDM solution, is this feature applicable for me?

Yes, this feature is applicable for you. Organizations that using third-party IDM solutions are advised to confirm with their vendor regarding current or future support for this feature.

❓ I've enabled the tenant-wide SOA feature. How do I create a shared mailbox in this scenario, given that shared mailboxes don't require a license?

There are two different ways to create a shared mailbox in this scenario:

Create the shared or equipment mailbox directly in the cloud, and do not create a corresponding user object in the on-premises directory.

or

Assign a temporary license to the user, and then convert the mailbox to a shared or equipment mailbox.