In Part 4 we will see how to troubleshoot Exchange Hybrid. This Blog Post Series consists of 6 parts. So if you missed one check them out as follows.

This post is split into multiple parts due to the complexitiy of a migration from Exchange and Skype for Business onPremise to Office 365 resp. Exchange Online and Teams.

Part 1 will cover the prerequisites like synchronize your onPrem users to Office 365 with Azure AD Connect.

Part 2 will cover migration from Exchange onPrem to Exchange Online and here especially Exchange Hybrid classic full.

Part 3 will cover moving user mailboxes from onPrem to Exchange Online.

Part 4 … will cover troubleshooting Exchange Hybrid

Part 5 will cover migration from Skype for Business onPrem users to Skype for Business Online and Teams.

Part 6 coming soon … will cover routing your onPrem SIP Trunk to Teams.

Troubleshooting Exchange Hybrid

After moving an user to Office 365, I tried to send an email to an external user and also I tried to send from this external user an email to my Office 365 user.

At this time, I tested and checked Enable centralized mail transport (CMT) on the Edge Server, also the MX Record still points to the onPrem environment, so all traffic outbound and inbound to and from Office 365, will traverse through the onPrem Edge Server.

Both mails stuck in queue, inbound to Office 365 on the Edge queue and the outbound from Office 365 on the Exchange Online queue 🙁

Here you can see the mail from an external user tried to send to my Office 365 user. This is the queue on my onPrem Edge Server which is responsible for the secure bi-directional mail transport between onPrem and Office 365.

451 4.4.395 Target host responded with error. -> 421 4.4.1 Connection timed out

Target host:

Also at Exchange Online (EAC), here under mailflowmessage trace, I can see that my mail from the Office 365 user mailbox send to an external user is in status pending.

Clicking on Details (the pen) will reveal more information about why it is in status pending.

Reason: [{LED=450 4.4.317 Cannot connect to remote server [Message=451 5.7.3 STARTTLS is required to send mail]

As you can see there are some problems regarding the secure TLS connection between Office 365 and my onPrem Edge Server.

Generally the Edge Server supports STARTTLS, so I suppose there are some problems regarding the certificate.

Because here Office 365 wants to connect to my Edge Server, I have to check the certificate from the Receive Connector on my Edge Server.

There we go, no certificate is assigned to the Receive Connector.

So we want to change this immediately, determine the thumbprint of your responsible certificate and assign it to the Receive Connector, in my case:

$Cert = Get-ExchangeCertificate -Thumbprint 9ae241799965c16866bc341bcdedd5f6d75c83a4
$TLSCertificateName = "<i>$($Cert.Issuer)<s>$($Cert.Subject)"

# also check that the certificate is enabled for SMTP
Enable-ExchangeCertificate -Thumbprint 9ae241799965c16866bc341bcdedd5f6d75c83a4 -Services SMTP

Set-ReceiveConnector "MAILGATE\Default internal receive connector MAILGATE" -TlsCertificateName $TLSCertificateName

Looks good 🙂

Mailflow issue from Exchange On-Prem to Office 365


In Part 5 … which is coming soon we will migrate our Skype for Business onPrem user to Teams …