Exchange Dedicated Hybrid App: What Admins Must Do Now

The dedicated hybrid app is a Microsoft Entra ID application that Exchange Server now uses to authenticate to Exchange Online for hybrid features such as Free/Busy, MailTips and profile pictures. It replaces the old model, in which every on-premises organization uploaded its Auth Certificate to the shared, Microsoft-owned "Office 365 Exchange Online" service principal.

The deadline has already passed. Since October 31, 2025, Exchange Online has permanently blocked EWS access through the shared service principal. If your hybrid organization hasn't moved to the dedicated app, cross-premises Free/Busy, MailTips and photos are already broken, and rolling back won't bring them back.

So the job now is fourfold: get every Mailbox server onto a supported build, create and enable the dedicated app with Microsoft's ConfigureExchangeHybridApplication.ps1 script (or the latest Hybrid Configuration Wizard plus a setting override), remove the old certificates from the shared service principal, and plan the move from EWS to Microsoft Graph on Exchange Server SE before EWS is shut down in Exchange Online in April 2027. For a screen-by-screen run of the script itself, see Configuring the Dedicated Exchange Hybrid Application in Microsoft Entra ID. This article covers the timeline, the decisions and the checklist around it.

Why Microsoft dropped the shared service principal

For years, the Hybrid Configuration Wizard (HCW) set up OAuth between Exchange Server and Exchange Online by uploading the on-premises Auth Certificate to the first-party "Office 365 Exchange Online" service principal in your tenant. Exchange Server then requested tokens as that shared Microsoft application.

Old model
Exchange Server --(Auth Certificate on SHARED Microsoft service principal)--> Exchange Online (EWS)

New model
Exchange Server --(Auth Certificate on YOUR dedicated Entra ID app)--> Exchange Online (EWS, then Graph)

The trigger was security. In August 2025 Microsoft disclosed CVE-2025-53786, an Exchange hybrid elevation-of-privilege issue tied to that shared trust, and CISA issued an emergency directive requiring US federal agencies to act on it. A dedicated app limits what a compromised on-premises server can reach.

There are two other benefits. Your own app appears in Entra ID sign-in logs and can be targeted with Conditional Access for workload identities, which the shared principal never could. And with EWS being retired in Exchange Online and Microsoft stripping EWS dependencies from its own products, Exchange hybrid needed an identity of its own before it could move to Microsoft Graph.

The dates that matter

Date	What happened or happens
April 2025	Microsoft announces the change. The April 2025 Hotfix Update (HU) for Exchange Server 2016 CU23 and 2019 CU14/CU15 adds support for the dedicated app.
August 2025	CVE-2025-53786 published. Microsoft urges all hybrid customers to configure the dedicated app and clean up the shared service principal.
September and October 2025	Short, temporary enforcement blocks of EWS through the shared service principal, to surface organizations that hadn't moved. The HCW is updated to create the dedicated app.
October 14, 2025	Exchange Server 2016 and 2019 reach end of support. Exchange Server Subscription Edition (SE) is the supported on-premises version.
October 31, 2025	EWS access through the shared service principal is permanently blocked. Rich coexistence works only through the dedicated app.
May 2026	The May 2026 HU for Exchange Server SE adds the Graph API-based hybrid flow, available first in the Microsoft 365 Global cloud.
October 1, 2026	Phased EWS disablement in Exchange Online begins. Tenants that haven't set EWSEnabled explicitly have it switched to False.
April 1, 2027	EWS in Exchange Online is permanently shut down, with no re-enablement.

The EWS dates come from Microsoft's EWS deprecation page and Message Center post MC1227454, as of October 2026. Microsoft has said they can still shift, so check the EWS deprecation page before you schedule work.

What breaks if you haven't moved

Without a working dedicated app, Free/Busy lookups fail in both directions between on-premises and cloud mailboxes. MailTips stop working, including automatic replies and mailbox-full warnings. Profile pictures stop being shared, and other features on the same OAuth path, such as moving on-premises items to a cloud archive mailbox, fail too.

Mail flow and directory synchronization don't use this path, so email keeps flowing. That is exactly why many organizations only notice when meeting scheduling starts showing blank availability.

Two traps make the situation worse. First, Microsoft's documentation is explicit that, since October 31, 2025, reverting to the shared service principal does not restore Free/Busy, MailTips or photos. Second, Mailbox servers below the supported builds can't take part in rich coexistence at all, even when the rest of the organization is configured correctly, so one forgotten server produces failures for just the users on it.

Who needs to act? Anyone who still relies on rich coexistence. If you have no on-premises mailboxes left and have decommissioned hybrid coexistence, you don't need the app. If any on-premises mailboxes remain and people schedule meetings with them, you do.

Supported builds

Microsoft's Deploy dedicated Exchange hybrid app documentation lists the minimum builds:

Version	Build	EWS workflow	Graph workflow
Exchange Server SE RTM with May 2026 HU	15.2.2562.41	Yes	Yes
Exchange Server SE RTM	15.2.2562.17	Yes	No
Exchange Server 2019 CU15 with April 2025 HU	15.2.1748.24	Yes	No
Exchange Server 2019 CU14 with April 2025 HU	15.2.1544.25	Yes	No
Exchange Server 2016 CU23 with April 2025 HU	15.1.2507.55	Yes	No

Exchange 2016 and 2019 at those builds still work with the EWS-based flow, but both products are out of support and only Exchange Server SE supports the Graph flow. If you keep on-premises mailboxes that interact with cloud mailboxes, Exchange Server SE is where you need to end up.

Check every server from the Exchange Management Shell:

Get-ExchangeServer | Format-Table Name, Edition, AdminDisplayVersion -AutoSize

Script or HCW?

Both routes end in the same configuration, but they leave different amounts of work behind.

Path	What it does	What you still do manually
ConfigureExchangeHybridApplication.ps1, All-in-one mode	Creates the app, uploads the Auth Certificate, configures the Auth Server, updates organization relationships and enables the feature via a setting override. Offers to add Graph permissions on supported builds.	Shared service principal clean-up
Script, Split execution mode	Runs the Entra ID steps on any internet-connected machine and the Exchange steps on a Mailbox server.	Export the Auth Certificate public key; clean-up
Latest HCW	Creates the dedicated app with EWS permissions.	Enable the feature with New-SettingOverride; run the script for clean-up and Graph permissions

I'd use the script's All-in-one mode wherever you can. It is one command, run on a Mailbox server with a supported build and outbound access to Microsoft Graph and Entra ID:

.\ConfigureExchangeHybridApplication.ps1 -FullyConfigureExchangeHybridApplication

Split mode is for the cases All-in-one can't handle: Mailbox servers with no outbound internet access, Server Core, or organizations where the Entra and Exchange admins are different people.

The HCW is the weakest option, because it creates the app but doesn't enable the feature, doesn't clean up the shared service principal and doesn't add Graph permissions. If you went that way, enable the feature yourself:

New-SettingOverride -Name "EnableExchangeHybrid3PAppFeature" -Component "Global" `
  -Section "ExchangeOnpremAsThirdPartyAppId" -Parameters @("Enabled=true") `
  -Reason "Enable dedicated Exchange hybrid app feature"
Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService `
  -Component VariantConfiguration -Argument Refresh

The admin checklist

Work through this in order. Each step is short, and skipping one is the usual cause of "we ran the script but Free/Busy still fails".

1. Confirm prerequisites

Hybrid must be configured as Classic Full or Modern Full with the HCW, and every Mailbox server must run a build from the table above. You need three sets of rights: Application Administrator (or Global Administrator) in Entra ID, Organization Management (or the narrower Exchange roles) on-premises, and Global Administrator for the shared service principal clean-up. The machine that creates the app must reach Entra ID and Graph:

Test-NetConnection -ComputerName login.microsoftonline.com -Port 443
Test-NetConnection -ComputerName graph.microsoft.com -Port 443

2. Create and enable the dedicated app

Run the script in All-in-one or split mode, or the HCW plus New-SettingOverride. In a multi-tenant (1:N) hybrid, run it once per tenant, signed in with an account from that tenant. Then allow up to 60 minutes for Exchange processes to pick up the change; Free/Busy and MailTips can be unavailable during that window, so do it out of hours.

3. Verify the configuration

# Setting override present?
Get-SettingOverride | Where-Object { $_.SectionName -eq "ExchangeOnpremAsThirdPartyAppId" }

# Auth Server now points to your app?
Get-AuthServer | Where-Object { $_.Name -like "*evoSTS*" } |
  Format-List Name, Realm, ApplicationIdentifier, DomainName

# Token request uses the dedicated app?
$r = Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com `
       -Mailbox "[email protected]"
$r.ResultType

A Success result whose detail contains your app's appId means Exchange Server obtained a token as the dedicated app. Don't stop there: test real Free/Busy in Outlook, in both directions.

4. Clean up the shared service principal

Once every server runs a supported build and the feature is enabled, remove the certificates the HCW previously uploaded to the shared "Office 365 Exchange Online" service principal:

.\ConfigureExchangeHybridApplication.ps1 -ResetFirstPartyServicePrincipalKeyCredentials

You can confirm the result with Microsoft Graph PowerShell. The well-known appId of Office 365 Exchange Online is 00000002-0000-0ff1-ce00-000000000000:

Connect-MgGraph -Scopes "Application.Read.All"
$sp = Get-MgServicePrincipal -Filter "appId eq '00000002-0000-0ff1-ce00-000000000000'"
$sp.KeyCredentials | Select-Object DisplayName, StartDateTime, EndDateTime

Watch for one regression. If you re-run the HCW later and choose the OAuth, Intra Organization Connector and Organization Relationship option, it uploads the certificate to the shared service principal again, and you'll need to repeat the clean-up.

5. Plan the Graph move

Upgrade to Exchange Server SE with the May 2026 HU or later.
Re-run the script with -FullyConfigureExchangeHybridApplication and accept the Graph permissions prompt. In split mode, use -UseGraphApiOnly.
Enable the Graph flow only in clouds where Microsoft lists it as supported, which at present means the Microsoft 365 Global cloud. Enabling it elsewhere breaks hybrid features.
In a 1:N setup, make sure Graph permissions are granted and consented in every tenant before you enable the Graph flow, or hybrid stops working for the tenants that aren't ready.
Keep the EWS permission (full_access_as_app) while you depend on anything Graph doesn't cover. Microsoft's current table shows Free/Busy and photos supported through Graph, MailTips only partially (automatic replies), and moving items to a cloud archive not yet supported.
When you no longer need EWS, remove it with .\ConfigureExchangeHybridApplication.ps1 -RemoveApiPermissions "EWS".

6. Operate and monitor

Your app's activity appears under Entra ID > Monitoring > Sign-in logs > Service principal sign-ins. If you have Workload Identities Premium licences, use Conditional Access for workload identities to restrict the app to your Exchange servers' public IPs.

When the Auth Certificate is renewed, upload the new one with .\ConfigureExchangeHybridApplication.ps1 -UpdateCertificate; Microsoft's MonitorExchangeAuthCertificate script helps you catch expiry early. Finally, add the dedicated app to your review of the EWS usage report in the Microsoft 365 admin center, so nobody mistakes it for an unknown third-party app during the EWS shutdown.

How the EWS retirement fits in

The dedicated app and the EWS retirement are related but separate changes. The first is finished: the shared service principal path has been closed since October 2025. The second is in progress: phased disablement began on October 1, 2026, and EWS is permanently removed from Exchange Online on April 1, 2027. On-premises Exchange Server keeps EWS; only Exchange Online is affected.

Microsoft's direction for hybrid is to replace EWS calls with Graph calls made through the dedicated app, and only Exchange Server SE supports that. Its cross-tenant Free/Busy guidance (MC1446796) explicitly puts hybrid out of scope and points hybrid customers to the dedicated app.

What Microsoft hasn't spelled out is exactly how the dedicated app's remaining EWS calls are treated during the October 2026 to April 2027 phase-out. My recommendation is to treat April 1, 2027 as a hard deadline for having Graph-based hybrid working on Exchange Server SE, and to watch the Exchange Team blog and Message Center for hybrid-specific notices. You can check your tenant's EWS setting in Exchange Online PowerShell:

Connect-ExchangeOnline
Get-OrganizationConfig | Format-List EWSEnabled

Troubleshooting by symptom

Symptom	Likely cause and fix
Free/Busy fails only for some on-premises users	Those mailboxes sit on a server with an unsupported build. Update every Mailbox server.
Test-OAuthConnectivity succeeds but users still fail	The test runs from the server hosting your shell session. Run it from each Mailbox server, and wait the full 60 minutes after enabling.
The script can't create the app	No outbound access to Graph and Entra ID, or missing Application Administrator rights. Use split mode if the server is locked down or runs Server Core.
Hybrid broke after enabling Graph	The Graph flow was enabled in an unsupported cloud, or permissions weren't consented in every tenant of a 1:N setup. Remove the Graph setting override and re-check.
Features stopped after a certificate renewal	The new Auth Certificate wasn't uploaded to the dedicated app. Run the script with -UpdateCertificate.

If Free/Busy was broken before any of this, for example through Autodiscover or EWS virtual directory authentication problems, the dedicated app won't fix it. Fixing Free/Busy Issues for Outlook in a Hybrid Exchange Setup covers those classic causes.