CISA Playbook: Harden Exchange Hybrid and Decommission EOL Servers After 365 Migration

CISA has published an urgent, practical playbook titled Microsoft Exchange Server Security Best Practices that tells organizations to harden on‑premises Exchange, adopt Microsoft’s hybrid hardening guidance, and decommission any remaining end‑of‑life (EOL) on‑premises or hybrid Exchange servers after moving mailboxes to Microsoft 365 — advice aimed squarely at reducing an ongoing, high‑risk attack surface that continues to attract threat actors.

Background / Overview​

Microsoft Exchange sits at the intersection of messaging, identity and enterprise workflows, so vulnerabilities that bridge on‑premises Exchange and Exchange Online have outsized impact. In 2025 a class of hybrid‑trust issues and follow‑on cumulative updates exposed this exact risk: a hybrid configuration model that used a shared service principal between Exchange on‑premises and Exchange Online allowed escalation of privileges from a compromised Exchange server into the cloud tenant. Governments and vendors escalated responses throughout the year — Microsoft issued configuration and update guidance, and CISA issued emergency direction and the new best‑practices guide to force the operational conversation from advisory into action.
Key changes and context to understand:

• The immediate risk centers on a hybrid authentication model that historically relied on a shared, first‑party service principal. That trust model could be abused by an attacker with on‑premises administrative access to mint or reuse tokens that Exchange Online would accept, enabling lateral escalation into cloud mailboxes and tenant configuration.
• Microsoft’s mitigation strategy has two tightly coupled technical elements: apply the April/October 2025 updates that add the configuration options and hardening, and adopt a tenant‑scoped dedicated Exchange hybrid application (a tenant‑owned service principal) so each tenant can rotate, audit and limit hybrid credentials independently.
• Starting in October 2025 Microsoft hardened Exchange further (including blocking export of the Exchange “Auth Certificate” via Export‑ExchangeCertificate), and announced that the October 2025 security updates are the last publicly released updates for Exchange Server 2016 and 2019 — with Extended Security Updates (ESU) offered only as a time‑limited, paid bridge through April 14, 2026.
• CISA’s new best‑practices guidance explicitly recommends not keeping a trailing “last Exchange server” in hybrid estates: retaining a single on‑premises Exchange box after migrating mailboxes to Microsoft 365 substantially increases ongoing attack risk.

---

What CISA’s guidance says (clear summary)​

CISA’s Microsoft Exchange Server Security Best Practices consolidates and amplifies the hardening steps organizations should take immediately and over the short term:

• Harden user authentication and access by enforcing multifactor authentication for administrative access, applying least‑privilege and role‑based access control, and limiting remote admin pathways.
• Ensure strong network encryption and perimeter controls — TLS for external services, WAFs or reverse proxies to protect OWA/EWS, and strict firewall rules that reduce direct internet exposure.
• Minimize application attack surface by removing or isolating unused Exchange roles, decommissioning legacy protocols, and applying vendor updates.
• Adopt Microsoft’s hybrid hardening workflow: install the April/October 2025 updates (as applicable) and run the ConfigureExchangeHybridApplication.ps1 workflow or updated Hybrid Configuration Wizard to create and validate a tenant‑scoped dedicated hybrid app, then run the Service Principal Clean‑Up Mode to rotate or remove stale credentials from shared principals.
• Decommission end‑of‑life on‑prem or hybrid servers after migrating mailboxes to Exchange Online; do not retain a “last Exchange server” as a management footnote — it becomes an enduring attack vector.
• If immediate migration isn’t possible, enroll only as an emergency contingency in Microsoft’s ESU program while accelerating an upgrade or migration plan; treat ESU as a bridge, not a strategy.

The guidance stresses operational sequencing: inventory first, patch and configure second, validate in pilot, then perform global cleanup and credential rotation. It also prescribes detection and incident response playbooks when suspicious activity is observed.

---

Why this guidance matters now​

A handful of technical realities make the CISA guidance materially important:

• The underlying hybrid trust issue requires that an attacker first achieve administrative control of an on‑premises Exchange host — a high bar — but once that foothold exists the attacker can forge or reuse hybrid tokens that are valid across the cloud boundary. Those tokens can be valid for long windows (research and incident analyses have observed token lifetimes in operational contexts that can reach many hours), creating a powerful escalation channel.
• Traditional cloud‑only monitoring will not reliably surface an on‑premises compromise that abuses hybrid trust. That means detection requires cross‑correlation of on‑prem Exchange host telemetry (IIS logs, w3wp events, PowerShell sessions) with cloud identity events in Entra ID and Exchange Online.
• Operational inertia and patch lag matter. Microsoft’s October 2025 updates marked the final public security rollups for Exchange 2016 and 2019; organizations that delay migration and remain on unsupported stacks will see the risk compound as paid ESU access ends in April 2026.
• Retaining a single “last Exchange server” in hybrid architectures is a frequent operational shortcut — but the advice to decommission that server reflects real risk: a single, under‑maintained server can be exploited to re‑establish hybrid trust abuse even after most mailboxes move to the cloud.

These factors combine to make the guidance both urgent and technically necessary for hybrid customers.

---

Technical details administrators must verify before acting​

Before running automated remediation at scale, validate the following environment facts:

• Inventory and build levels: confirm the exact Exchange build and CU/HU/SU numbers on every Exchange server using the Exchange Health Checker. Updates are cumulative; install the specific SU/HU that maps to each server’s CU and SKU.
• Hybrid participation: identify which servers are configured for hybrid features (Free/Busy, MailTips, profile photos, hybrid mail routing) and which servers are management/edge only.
• Certificate usage and automation: find any tools, scripts or backup processes that previously exported the Exchange Auth Certificate with Export‑ExchangeCertificate (that capability is blocked in recent SUs) and prepare to use MonitorExchangeAuthCertificate for diagnostics instead.
• Third‑party integrations: enumerate archiving, journaling and SMTP relays; verify compatibility with target Exchange SE builds or Exchange Online migration patterns.
• Identity mappings: list service principals and keyCredentials that are attached to shared Microsoft service principals; plan credential rotation windows and record telemetry baselines before cleanup runs.

If these facts are not confirmed, cleanup scripts or HCW re‑runs can reintroduce legacy credentials or break hybrid flows.

---

Practical, prioritized remediation — an operational playbook​

The following runbook condenses the optimal sequence to reduce risk quickly while minimizing disruption.

• Inventory (day 0–2)
• Run Exchange Health Checker across all Exchange servers and capture CU/HU/SU versions and hybrid participation.
• Identify internet‑facing endpoints and servers hosting privileged users’ mailboxes.
• Patch (day 0–7)
• Apply the appropriate April/October 2025 hotfixes or SUs for your CU/SKU in a tested pilot ring first.
• Reboot and confirm the patch applied by checking build numbers and KB mappings.
• Create dedicated hybrid app (day 3–21)
• Use ConfigureExchangeHybridApplication.ps1 or updated HCW to create a tenant‑scoped dedicated Exchange hybrid app in Entra ID.
• Test Free/Busy, MailTips and profile photo flows in a small pilot group.
• Credential cleanup and rotation (after successful pilot)
• Execute Service Principal Clean‑Up Mode to remove legacy keyCredentials from the shared service principal and rotate credentials for the dedicated hybrid app.
• Validate hybrid flows again after cleanup.
• Harden and monitor (ongoing)
• Enforce MFA and conditional access on admin accounts, enable just‑in‑time privileged access, and restrict admin access to jump hosts.
• Add EDR/host telemetry on Exchange hosts and centralize logs in a SIEM that correlates on‑prem and cloud events.
• Decommission or migrate (strategic)
• If mailboxes are migrated to Exchange Online, retire on‑prem servers. Do not retain a “last Exchange server” as a management convenience.
• If migration is delayed, enroll in ESU only as a short‑term bridge, and accelerate migration planning.

This sequence reduces the attack surface while preserving hybrid functionality during transition.

---

Detection, hunting, and incident response guidance​

Because hybrid abuse can produce weak cloud signals, detection and response must be multi‑domain and immediate:

• Expand logging on Exchange hosts: collect IIS, ECP, OWA, and PowerShell remote management logs centrally.
• Hunt for anomalous token and service principal activity in Entra ID: unexpected token issuance, long‑lived tokens or token issuance outside maintenance windows are red flags.
• Monitor kernel and process telemetry on Exchange hosts for suspicious child processes, web shell activity, unexpected scheduled tasks or binary tampering.
• If compromise is suspected:
• Isolate the server from the network and perform live forensic capture (memory, disk images).
• Preserve IIS logs and Exchange audit logs; collect package manifests and WSUS logs if update infrastructure concerns exist.
• Rotate or revoke service principal credentials and re‑issue tenant‑scoped keys, while ensuring hybrid flows are validated before cleanup.
• Report to organizational incident contacts and regulatory reporting channels as required.

Preserving evidence before rebooting or patching a suspected compromised host is critical for post‑incident analysis and for preventing unnoticed propagation to cloud resources.

---

Strengths of the CISA guidance​

• Authoritative, actionable direction: CISA’s guidance refocuses attention on concrete, measurable actions administrators can take — inventory, patch, create dedicated hybrid app, rotate credentials, and retire EOL servers.
• Operational clarity on critical technical steps: By endorsing Microsoft’s official scripts and updated HCW flows, the guidance reduces ambiguity about how to perform migration and credential cleanup.
• Risk‑reducing policy position on EOL servers: Recommending decommissioning of remaining EOL or hybrid servers after migration addresses a persistent operational loophole that repeatedly enables attackers.
• Coordination with vendor fixes and enforcement schedules: The guidance aligns with Microsoft’s enforcement timelines, giving organizations a clear timetable to plan around.

---

Limitations and residual risks (what the guidance doesn’t solve on its own)​

• It depends on customer execution. The mitigations require accurate inventories, testing, and coordinated credential rotations across potentially global estates. Many enterprises struggle with the manpower and change management needed to complete these tasks quickly.
• Operational disruption risk is real. Enforcement windows and HCW/cleanup sequencing can cause service degradations — particularly to rich coexistence features — if run without proper pilot validation.
• Visibility gaps remain. Because certain hybrid abuses originate on‑premises, cloud auditing alone is insufficient; organizations with weak host‑level telemetry or centralized logging remain at risk.
• Third‑party compatibility and legacy integrations complicate migration. Appliances, archivers and journaling solutions often require rework or vendor updates to function with newer Exchange builds or Exchange Online.
• ESU is a limited bridge, not a strategy. Paying for ESU buys time but does not address operational debt; once ESU expires, organizations still need to migrate or risk running unsupported software.

The guidance raises the bar, but execution risk — especially for large distributed organizations — is the primary remaining challenge.

---

Specific operational gotchas and caveats​

• HCW re‑runs can reintroduce legacy credentials. Re‑running the Hybrid Configuration Wizard without following the documented sequence may re‑upload auth certificates to the shared app and undo a prior cleanup. Plan HCW runs carefully and document every step.
• Export of the Auth Certificate is blocked. Recent SUs block Export‑ExchangeCertificate for the Exchange Auth Certificate; any automation relying on that behavior must be updated to use MonitorExchangeAuthCertificate and supported diagnostics.
• Staged rollouts are essential. Apply updates in a pilot ring first; verify mail flow and hybrid sync jobs; only then move to production. Maintain rollback plans and test uninstallation scenarios where possible.
• Credential rotation timing matters. Do not remove keyCredentials from the shared service principal until all on‑prem Exchange servers are confirmed to be using the dedicated hybrid app; premature cleanup will break rich coexistence functions.
• Inventory accuracy is non‑negotiable. Undiscovered or forgotten Exchange appliances create blind spots that can be exploited during or after migration.

---

Governance and organizational recommendations​

• Establish an internal remediation deadline that falls before public enforcement windows. Treat Microsoft’s enforcement dates as the absolute outside limit, and set an earlier internal cutover to avoid last‑minute emergency actions.
• Create and rehearse an Exchange migration playbook covering testing, HCW/ConfigureExchangeHybridApplication scripts usage, credential rotation, and rollbacks.
• Assign clear cross‑functional ownership (Exchange, identity, network, security, application owners) for the entire migration and decommission plan.
• Document every cleanup step and keep audit trails: which servers were patched, when credentials were rotated, and how hybrid flows were verified.
• Budget for migration/SE costs now: migration to Exchange SE or Exchange Online will have licensing, operational and sometimes hardware implications that require procurement lead time.

---

Recommended hardening checklist (concise)​

• Enforce MFA for all administrator accounts and protect privileged credentials with just‑in‑time and privileged access management.
• Limit Exchange management access to internal networks or jump hosts and restrict administrative operations by IP and role.
• Patch all Exchange servers to the appropriate April/October 2025 HUs/SUs and confirm installation.
• Create and validate a tenant‑scoped dedicated Exchange hybrid app; do not rely on shared first‑party credentials.
• Rotate or remove legacy service principal keyCredentials only after full validation.
• Deploy WAFs, reverse proxies, or VPNs to remove direct internet exposure for OWA/ECP/EWS where possible.
• Enable EDR and centralize Exchange host telemetry in a SIEM; correlate host and cloud identity events.
• Plan to retire the last Exchange server immediately after migration to Exchange Online and do not retain it for convenience.

---

Final assessment — strengths, practical risks and the path forward​

CISA’s Microsoft Exchange Server Security Best Practices is a needed, direct call‑to‑action: it ties vendor guidance to federal‑level urgency and frames migration and decommissioning as not just best practice but as risk reduction imperative. The shift to tenant‑scoped hybrid apps is technically sound and aligns with least‑privilege and zero‑trust principles; blocking export of critical auth keys reduces a dangerous operational path for key exfiltration.
That said, guidance alone will not close the gap — the hardest work is operational: large estates, disparate teams, legacy integrations and constrained change windows create the real-world friction that lets exploitable systems persist. Organizations must pair this guidance with tight project governance, prioritized patching, cross‑domain telemetry, and practical migration investments.
The immediate takeaway for every technical leader running Exchange hybrid or on‑premises is clear and uncompromising: inventory now, patch and enable the dedicated hybrid app rapidly, rotate and clean up credentials carefully, and plan to retire any remaining EOL Exchange servers after mailboxes move to the cloud. Treat ESU strictly as a last‑resort stopgap, not as an acceptable long‑term posture.
Following the CISA playbook will materially reduce the likelihood that a single compromised Exchange host becomes the gateway to a tenant‑wide cloud breach. The window for action is now — the operational work is gritty, but it prevents a class of attacks that can otherwise be both stealthy and consequential.

---

Source: CISA New Guidance Released on Microsoft Exchange Server Security Best Practices | CISA