Migrate to the Dedicated Exchange Hybrid App: Urgent Guide

Microsoft’s Exchange team has given hybrid administrators a clear-but-urgent migration mandate: switch to the dedicated Exchange hybrid app and update on‑prem servers now, or face temporary disruptions in September and October followed by a permanent enforcement that will stop rich coexistence features unless the dedicated app is configured. (techcommunity.microsoft.com) (learn.microsoft.com)

Background / Overview​

Microsoft’s hybrid Exchange architecture historically used a shared, Microsoft‑managed service principal (the well‑known Office 365 Exchange Online app with AppId 00000002‑0000‑0ff1‑ce00‑000000000000) to enable secure calls between on‑premises Exchange and Exchange Online. That model simplified setup but concentrated cross‑boundary trust in a multi‑tenant identity — a design Microsoft now says is too risky for modern hybrid deployments. The April 2025 guidance first introduced the plan to move to a customer‑managed, dedicated Exchange hybrid application in each tenant to regain control, reduce the attack surface, and prepare for a future move from Exchange Web Services (EWS) to Microsoft Graph for hybrid calls. (techcommunity.microsoft.com) (learn.microsoft.com)
Why the change is being accelerated now: Microsoft has announced short, planned EWS traffic blocks that target traffic authenticated with the legacy shared service principal to force adoption. Those temporary blocks — together with a final permanent cutoff after October 31, 2025 — are designed to ensure customers who need “rich coexistence” (free/busy lookups, MailTips, and profile picture sharing) complete the migration steps before those capabilities are interrupted. The Exchange team also updated the Hybrid Configuration Wizard (HCW) to create the dedicated app for customers that prefer a guided flow. (techcommunity.microsoft.com)

---

What’s changing — the technical nutshell​

• The hybrid trust model that uses the shared Exchange Online service principal will be phased out for rich coexistence scenarios; customers must adopt a tenant‑scoped ExchangeServerApp-{GUID} application. (learn.microsoft.com)
• EWS calls from on‑prem Exchange to Exchange Online are being replaced by Graph‑based hybrid calls over time; Microsoft plans to complete the Graph permission updates by October 2026, with the first enforcement milestones in October 2025. (techcommunity.microsoft.com)
• Temporary EWS traffic blocks to the shared service principal will be used in August–October 2025 as nudges; a permanent block of the shared principal is scheduled after October 31, 2025. (Microsoft later cancelled the first August block to give customers more time.) (techcommunity.microsoft.com)

---

The enforcement timeline you need to know (exact dates)​

Microsoft’s public schedule and subsequent updates list the following enforcement windows for temporary EWS blocking of the shared service principal:

• First planned block (originally): August 19, 2025 — cancelled to give customers additional time. (techcommunity.microsoft.com)
• 2nd block: September 16, 2025 — planned 2‑day temporary block. (techcommunity.microsoft.com)
• 3rd block: October 7, 2025 — planned 3‑day temporary block. (techcommunity.microsoft.com)
• Final enforcement: after October 31, 2025 — permanent block on the shared service principal for EWS access; hybrid rich coexistence features will stop functioning if dedicated app is not in place. (techcommunity.microsoft.com)

Those dates are absolute and non‑negotiable for the final enforcement: after October 31 the legacy flow will not be accepted by Exchange Online for the shared principal, and organizations still relying on it will see free/busy lookups, MailTips, and profile photos fail for on‑prem → cloud directions. (techcommunity.microsoft.com)

---

Who will be affected​

Only a subset of hybrid customers will be impacted by the temporary blocks or the final enforcement:

• Organizations with mailboxes both on‑premises and in Exchange Online (hybrid).
• Organizations that use rich coexistence: free/busy calendar lookups, MailTips, and profile picture sharing across on‑prem and online mailboxes.
• On‑prem Exchange servers that have not been updated to the April 2025 hotfix/minimum builds that add dedicated hybrid app support.
• Tenants that have not created and enabled the dedicated Exchange hybrid app (either via the provided ConfigureExchangeHybridApplication.ps1 script or via the updated HCW plus the required Setting Override). (techcommunity.microsoft.com)

If your environment doesn’t match these conditions (for example, all mailboxes are on‑prem, or you don’t rely on the three rich coexistence features), you will likely be unaffected by the functional breaks — but Microsoft still recommends cleaning up legacy uploaded certificates from the shared service principal to harden your tenant. (learn.microsoft.com)

---

Exactly what will break (and what will not)​

During the temporary enforcement windows (and permanently after October 31 if you haven’t migrated), impacted customers will see the following fail — only in the direction of on‑prem mailboxes querying Exchange Online mailboxes:

• Free/Busy calendar availability lookups
• MailTips (for on‑prem mailboxes obtaining MailTips about cloud mailboxes)
• Profile picture sharing

Everything else in Exchange hybrid (mailbox moves, mail flow, SMTP relay, recipient management, etc.) is not part of this enforcement and will continue to work. The enforcement is strictly scoped to EWS‑based rich coexistence flows that use the shared service principal. (techcommunity.microsoft.com)

---

Required actions — a practical, prioritized checklist​

Follow this prioritized operational plan to avoid disruption:

• Inventory and assess (immediate)
• Run Exchange Health Checker and inventory all Exchange servers and hybrid relationships. CISA and Microsoft urged rapid assessment in August 2025. (cisa.gov, techcommunity.microsoft.com)
• Identify which servers provide hybrid rich coexistence and which tenants were targeted by the Microsoft Message Center notice (MC1085578). (techcommunity.microsoft.com)
• Verify server builds and apply April 2025 HUs (next 24–72 hours for high‑risk systems)
• Minimum supported builds for dedicated hybrid app support are listed in Microsoft documentation:
• Exchange Server 2016 CU23 — 15.1.2507.55 or higher
• Exchange Server 2019 CU14 — 15.2.1544.25 or higher
• Exchange Server 2019 CU15 — 15.2.1748.24 or higher
• Exchange Server Subscription Edition (SE) RTM — 15.2.2562.17 or higher. (techcommunity.microsoft.com, learn.microsoft.com)
• Create the dedicated Exchange hybrid app
• Option A (script — recommended for many): Run ConfigureExchangeHybridApplication.ps1 in All‑in‑one or Split Execution mode as documented. The script creates ExchangeServerApp‑{GUID}, grants the EWS application permission (full_access_as_app for now), uploads auth certificates, and can optionally enable the feature on‑prem via a Setting Override. (learn.microsoft.com)
• Option B (HCW): Use the updated Hybrid Configuration Wizard to create the dedicated app — HCW will create the app and upload certificates, but note HCW will not perform cleanup of the legacy shared service principal nor automatically create the Setting Override to enable the feature on‑prem. You must run New‑SettingOverride manually after HCW if you want to enable the feature. (techcommunity.microsoft.com, learn.microsoft.com)
• Grant tenant‑wide admin consent
• The dedicated app needs tenant‑wide consent to operate. HCW and the script will prompt for this; if you skip consent the app will be created but not functional (HCW emits HCW8126). (techcommunity.microsoft.com)
• Clean up the legacy shared service principal
• Run the script in Service Principal Clean‑Up Mode to remove custom certificates from the Office 365 Exchange Online first‑party service principal. This reduces lingering credential exposure even if you don’t need the dedicated app. Cleanup can be executed from a non‑Exchange server. Do not remove keyCredentials while any Exchange server still requires the shared principal (you will break those servers). (learn.microsoft.com)
• Test and validate
• Test free/busy queries, MailTips, and photo sharing after cutover. Allow up to 60 minutes for newly created dedicated apps to propagate to Exchange processes, per documentation. (learn.microsoft.com)
• Monitor and harden
• Rotate and securely store app secrets/certificates, apply Conditional Access for workload identities where needed, and add the dedicated app to your audit and monitoring coverage. Microsoft recommends adding workload identity conditional access only where you have Workload Identities Premium or the required licensing. (learn.microsoft.com)

---

HCW vs PowerShell script — differences that matter​

• The PowerShell script (ConfigureExchangeHybridApplication.ps1) can: create the app, upload certificates, enable the feature via the Setting Override, and optionally clean up the legacy shared service principal’s keyCredentials. (learn.microsoft.com)
• The updated HCW can create the dedicated Exchange hybrid app and upload certificates, but it does not clean up the shared service principal and does not automatically enable the on‑prem feature via Setting Override — that must be performed manually with New‑SettingOverride or by running the script in the appropriate mode. HCW also requires tenant‑wide admin consent to make the app functional. (techcommunity.microsoft.com, learn.microsoft.com)

Practical implication: Many admins will choose the script path when they want a one‑stop operation that creates the app and enables the on‑prem feature; others will use HCW for a guided creation and then run the Setting Override and cleanup steps manually.

---

The security driver: CVE‑2025‑53786 and CISA’s ED 25‑02​

The migration is not just about convenience — it’s about closing a severe hybrid risk. Microsoft and Microsoft Defender Vulnerability Management describe CVE‑2025‑53786 as a post‑authentication elevation‑of‑privilege vulnerability in hybrid Exchange setups that allows an attacker who already has admin rights on an on‑prem Exchange server to escalate into Exchange Online because the shared service principal creates an implicit trust path. The CVSS score and public advisories (and CISA’s Emergency Directive ED 25‑02) emphasize the urgency. Federal civilian agencies were required to take mitigation actions by 9:00 AM EDT on August 11, 2025 in response to this vulnerability. (cisa.gov)
Independent security vendors (Tenable) and multiple media reports underscored the same guidance: apply the April 2025 hotfixes, deploy the dedicated hybrid app, and remove stale keyCredentials from the shared principal. Those third‑party voices echo Microsoft and CISA on mitigation priorities. (tenable.com, techradar.com)

---

Operational risks and common pitfalls​

• Mis‑timing and disruption: Temporary blocks are short but intentional. If you delay, you risk seeing free/busy and profile photos fail during the September/October windows — and permanent failure after October 31. Microsoft has already canceled one early window (August) to allow more time, but the remaining schedule is still strict. (techcommunity.microsoft.com)
• Admin consent and broken app behavior: If you create the app but do not grant tenant‑wide admin consent, the app will be created but non‑functional. HCW and the script both surface the need for consent; skip it at your peril. (techcommunity.microsoft.com)
• Secrets & lifecycle management: The dedicated app introduces new credentials (client secrets or certs) that you must protect, rotate, and log. Poor management of these secrets undermines the security benefit of moving away from a shared principal.
• Cleanup timing: Removing keyCredentials from the shared service principal while older Exchange servers still rely on it will break those servers. Only remove keys after all on‑prem servers are at or above the supported builds and the dedicated app is enabled. (learn.microsoft.com)
• Third‑party integrations and scripts: Any third‑party apps, scripts, or automation that rely on EWS flows authenticated to the shared principal will need to be audited and updated. Some ISV integrations may need rework to authenticate against the dedicated app or to migrate to Graph. (techcommunity.microsoft.com)
• Rollback limitations: HCW does not support rollback for the dedicated app configuration. The script can delete the dedicated app and the Setting Override can be removed, but HCW offers no built‑in rollback; document your change control and test in a pilot before broad rollout. (techcommunity.microsoft.com)

---

Practical runbook — suggested step sequence for a medium/large tenant​

• Run Exchange Health Checker and map all hybrid relationships. (T = Day 0) (cisa.gov)
• Confirm all Exchange servers meet the minimum April 2025 HU builds. If not, schedule maintenance to install required HUs. (T+1 to T+7) (techcommunity.microsoft.com)
• In a non‑production tenant (or pilot OU), run ConfigureExchangeHybridApplication.ps1 — All‑in‑one mode — and validate creation of ExchangeServerApp‑{GUID}. (T+8) (learn.microsoft.com)
• Grant tenant‑wide admin consent and enable the Setting Override (or run the script to enable it). Validate free/busy and MailTips end‑to‑end. (T+9) (learn.microsoft.com)
• Run the script in Service Principal Clean‑Up Mode to remove custom keyCredentials from the shared service principal only after all servers are on supported builds and the dedicated app is functioning. (T+10) (learn.microsoft.com)
• Monitor EWS/Graph traffic and authentication logs; add alerts for failed free/busy requests and increased authentication errors. (Ongoing)

This sequence minimizes blast radius and ensures you won’t accidentally orphan on‑prem servers by prematurely cleaning the shared principal.

---

Validation, testing and what to watch for after migration​

• Confirm the dedicated app’s keyCredentials are present and valid (use Microsoft Graph PowerShell queries recommended by Microsoft). (techcommunity.microsoft.com)
• Test cross‑environment Free/Busy lookups, MailTips rendering, and profile photo retrieval across representative mailboxes. Allow a propagation window (Microsoft documents up to ~60 minutes for recognition). (learn.microsoft.com)
• Monitor Microsoft 365 sign‑in and audit logs for unusual token activity from the newly created app. Treat unexpected consent grants, unusual refresh rates, or long‑lived secrets as red flags. (learn.microsoft.com, techcommunity.microsoft.com)
• If you rely on Graph migration plans, follow Microsoft’s Graph‑permission guidance when the Graph‑based hybrid update ships (planned Q3 2025 for initial Graph support; Graph permissions enforcement by Oct 2026). (techcommunity.microsoft.com)

---

Final analysis — strengths, tradeoffs, and timeline risk​

Microsoft’s move to a dedicated, tenant‑scoped hybrid application is a sound security design: it places identity control and credential lifecycle squarely in customers’ tenants, enables better auditing and Conditional Access for hybrid workload identities, and reduces a systemic attack vector that could let an on‑prem compromise turn into cloud compromise. That fact underpins CISA’s ED and the broad security community’s advice to act quickly. (techcommunity.microsoft.com, cisa.gov)
Tradeoffs and operational pain points are real: the migration requires coordinated server updates, admin consent, secret management, and careful timing of legacy credential cleanup — all during a months‑long window where Microsoft will deliberately create short outages to accelerate adoption. Those short outages are an operational lever; they increase the urgency but also raise the probability of service‑impacting mistakes for teams that move too quickly or skip validation. (techcommunity.microsoft.com, learn.microsoft.com)
Given the potential for silent lateral escalation (the central security concern Microsoft described), the risk calculus favors rapid, measured action: patch, create the dedicated app, enable it in a pilot, validate, and then clean up the shared principal. CISA’s emergency directive and multiple vendor advisories reinforce that waiting is riskier than temporary rollout disruption. (cisa.gov, tenable.com)

---

Quick reference — what to do this week​

• Inventory hybrid servers and determine whether you use Free/Busy, MailTips, or photo sharing. (techcommunity.microsoft.com)
• If you have hybrid features in use, schedule Exchange updates (April 2025 HU or later) and plan to run ConfigureExchangeHybridApplication.ps1 or re‑run HCW with the dedicated app option. (learn.microsoft.com)
• Plan to grant tenant‑wide admin consent during your HCW/script run (or re‑run HCW if you created the app without consent). (techcommunity.microsoft.com)
• Do not remove keyCredentials from the shared service principal until every server is updated and confirmed to work with the dedicated app. (learn.microsoft.com)

---

Microsoft’s messaging is unequivocal: the dedicated Exchange hybrid app is the required long‑term model for secure rich coexistence, and the enforcement windows (including the permanent cutoff after October 31, 2025) mean that hybrid administrators must treat this as an operational imperative rather than a future item on a maintenance list. Act now, test carefully, and document each step — because after October 31, the old shared path will no longer be an option. (techcommunity.microsoft.com, learn.microsoft.com)

---

Note: This article used Microsoft’s Exchange team announcements and the Deploy dedicated Exchange hybrid app documentation for the technical requirements and schedule, as well as CISA and security vendor advisories to corroborate the vulnerability and the required urgency. The content reflects the latest published guidance and official enforcement timeline; any deviation in Microsoft’s public schedule would be reflected in follow‑up updates from Microsoft and government advisories. (techcommunity.microsoft.com, learn.microsoft.com, cisa.gov)

---

Source: Microsoft Exchange Team Blog Dedicated Hybrid App: temporary enforcements, new HCW and possible hybrid functionality disruptions | Microsoft Community Hub

 

[ChatGPT]

Microsoft's updated Exchange hybrid guidance — and a last‑minute change to the enforcement cadence — should be on every hybrid admin’s radar: the Exchange team has expanded the push to migrate hybrid traffic away from the long‑standing Exchange Online shared service principal into a tenant‑owned dedicated Exchange hybrid app, introduced an updated Hybrid Configuration Wizard (HCW) to help, and announced short, scheduled EWS traffic blocks designed to force action ahead of a permanent cutoff after October 31, 2025. The first planned August enforcement has been cancelled to give customers extra time, but the remaining temporary blocks in September and October remain on the calendar and the permanent block follows at the end of October. (techcommunity.microsoft.com)

Background / Overview​

Microsoft’s hybrid design historically relied on a Microsoft‑managed, multi‑tenant shared service principal (the Office 365 Exchange Online app) to authenticate and enable EWS‑based coexistence features between on‑premises Exchange and Exchange Online. That model simplified setup but concentrated trust in a shared identity and credentials that live outside customers’ control. Recent security research and an associated Microsoft advisory (CVE‑2025‑53786) show how that implicit trust can be abused: a compromise of an on‑prem Exchange admin can allow stealthy escalation into the connected Exchange Online tenant. In response, Microsoft is moving to a model where each customer creates and controls a tenant‑specific dedicated hybrid app in Microsoft Entra ID. (learn.microsoft.com, cisa.gov)
The changes break down into two phases:

• Immediate security hardening: install the April 2025 hotfix updates for Exchange and create a dedicated Exchange hybrid app (via the provided PowerShell script or the updated HCW) so on‑prem servers stop using the shared service principal.
• Longer‑term API migration: later updates will switch hybrid servers from EWS calls to the Microsoft Graph API and update the dedicated app permissions to a more granular Graph permission model; that second step is expected before October 2026. (learn.microsoft.com, techcommunity.microsoft.com)

Microsoft’s public blog post lays out a clear enforcement timeline that includes temporary EWS blocking windows to accelerate adoption and a final permanent block after October 31, 2025. The Exchange team updated that post on August 18, 2025 to cancel the originally planned August 19 temporary block and said the enforcement schedule will resume in September; admins must still act fast.

---

What changes, precisely — and what will stop working if you don’t act?​

The narrow, real impact (but wide operational risk)​

Microsoft has been explicit about the scope of impact for the temporary enforcement windows: only three “rich coexistence” features are affected when the shared service principal is blocked for EWS traffic, and only in the direction where on‑premises mailboxes try to query Exchange Online mailboxes:

• Free/Busy (calendar availability) lookups from on‑prem to cloud mailboxes
• MailTips (cloud mailbox MailTips shown to on‑prem users)
• Profile photo sharing between cloud mailboxes and on‑prem users

All other Exchange hybrid functionality (mail flow, transport, migration controls, etc.) is not scheduled to be blocked by these temporary EWS enforcement windows. The key caveat: if you rely on those three features across the hybrid boundary, and your on‑prem servers still use the shared service principal (and are not updated to a build that supports the dedicated app), then users will briefly lose those features during each enforcement window and permanently after October 31 if no action is taken. (techcommunity.microsoft.com, learn.microsoft.com)

The enforcement schedule (updated)​

Microsoft’s published schedule (after the Aug 18 change) is:

• September 16, 2025 — temporary block (2 days). (techcommunity.microsoft.com)
• October 7, 2025 — temporary block (3 days). (techcommunity.microsoft.com)
• After October 31, 2025 — permanent block of the shared service principal for EWS; hybrid rich coexistence features that still depend on the shared principal will stop working unless the dedicated app is configured. (techcommunity.microsoft.com)

Note: Microsoft cancelled the original August enforcement to give customers more time, but the remaining windows are live in the published schedule; there will be no exceptions granted for these temporary blocks.

---

Why Microsoft is doing this: the security case​

The shared principal design yields a powerful implicit trust between on‑prem Exchange and cloud Exchange Online. When that trust is combined with long‑lived certificates or credential artifacts in a shared multi‑tenant principal, an attacker who gains administrative access to an on‑prem Exchange server could leverage those artifacts to escalate privileges into the cloud while leaving few obvious cloud audit trails. That’s the problem highlighted by CVE‑2025‑53786 and the related guidance from Microsoft and CISA; Microsoft’s mitigation is architectural: remove the shared, Microsoft‑managed principal and require a customer‑controlled application for hybrid operations. Government and vendor advisories have echoed the severity and urged immediate remediation. (cisa.gov, helpnetsecurity.com)
Security benefits of the dedicated app model:

• Tenant‑owned identity: app registration lives in your Entra tenant; you control consent, certificates, and rotation.
• Improved auditability: sign‑ins and service principal usage are visible in Entra audit logs specific to tenant app sign‑ins.
• Least‑privilege posture: future Graph API permission model moves toward more granular scopes instead of broad EWS application permissions. (learn.microsoft.com, techcommunity.microsoft.com)

Risks introduced by the change (realistic operational risks to plan for):

• New app credentials become your responsibility — poor secret management can introduce new vulnerabilities.
• The migration involves identity and OAuth configuration changes; missteps can break coexistence features or automation.
• The temporary EWS block windows create finite windows of user impact that can affect busy teams during payroll, tax season, or other critical dates if not planned. (techcommunity.microsoft.com, learn.microsoft.com)

---

Verified technical specifics you must know now​

The minimum Exchange Server builds that support the dedicated Exchange hybrid app are published in the documentation and must be installed before enabling the dedicated‑app feature:

• Exchange Server 2016 CU23 — April 2025 Hotfix (15.1.2507.55 or higher).
• Exchange Server 2019 CU14 — April 2025 Hotfix (15.2.1544.25 or higher).
• Exchange Server 2019 CU15 — April 2025 Hotfix (15.2.1748.24 or higher).
• Exchange Server Subscription Edition RTM — 15.2.2562.17 or higher. (learn.microsoft.com, techcommunity.microsoft.com)

Validation command (use after you configure): from an Exchange Management Shell, you can verify OAuth connectivity using Test‑OAuthConnectivity (example published by Microsoft):
Test‑OAuthConnectivity -Service EWS -TargetUri Outlook -Mailbox "<OnPremisesMailboxSmtpAddress>"
If the ResultType is Success and the detail contains the dedicated app’s appId, OAuth token acquisition succeeded and the dedicated app is in use. This command is part of the Microsoft guidance and should be included in any validation checklist. (learn.microsoft.com)
HCW behavior vs. PowerShell script (what each will and won’t do)

• Both HCW and the ConfigureExchangeHybridApplication.ps1 script will create the dedicated app in Entra ID and upload auth certificates.
• The script can optionally perform Service Principal Clean‑Up Mode to remove keyCredentials from the shared “Office 365 Exchange Online” application; HCW does not perform that cleanup.
• The script can also create the on‑prem Setting Override (EnableExchangeHybrid3PAppFeature) to enable the feature on the Exchange organization; HCW creates the app but does not automatically enable the on‑prem setting override. You must create the Setting Override (for example, with New‑SettingOverride) after HCW or use the script’s All‑in‑one mode to enable the feature. (learn.microsoft.com, techcommunity.microsoft.com)

These operational differences are important: creating the app in Entra is only part of the work — you must enable the feature on‑premises and validate token acquisition before you can safely clean up the shared principal credentials. (learn.microsoft.com, techcommunity.microsoft.com)

---

Practical, prioritized checklist — what admins should do this week​

Follow this checklist promptly. It’s ordered by impact and speed of mitigation.

• Inventory and triage (immediate)
• Identify all Exchange servers that participate in hybrid (run Exchange Health Checker and inventory hybrid relationships). Treat on‑prem mailbox hosts and hybrid relationship servers as highest priority.
• Identify whether you use rich coexistence features (free/busy, MailTips, profile photos) across the hybrid boundary.
• Patch/Update (24–72 hours)
• Apply the April 2025 Hotfix (or a later cumulative update) to all on‑prem Exchange servers that participate in hybrid, to ensure the builds listed above are installed. This is non‑negotiable for the dedicated app model. (learn.microsoft.com, techcommunity.microsoft.com)
• Create the dedicated Exchange hybrid app (next operational window)
• Option A (recommended for most orgs): Run ConfigureExchangeHybridApplication.ps1 in All‑in‑one mode on a mailbox server that has outbound connectivity — this creates the app, uploads certificates, grants tenant‑wide consent (you must approve), and can create the Setting Override that enables the feature on‑prem. Follow the script guidance carefully and capture the AppId/TenantId. (learn.microsoft.com)
• Option B: Re‑run the updated Hybrid Configuration Wizard (HCW) and choose the “Deploy dedicated Exchange hybrid app” option. After HCW completes, manually create the Setting Override to enable the feature on‑prem and be prepared to run the cleanup script separately. (techcommunity.microsoft.com, learn.microsoft.com)
• Validate (after configuration)
• Use Test‑OAuthConnectivity for EWS and check Entra sign‑in logs for service principal sign‑ins. Confirm the dedicated app’s appId appears in successful token acquisitions. Only after validation should you remove certificates from the shared service principal. (learn.microsoft.com, techcommunity.microsoft.com)
• Clean up shared principal credentials (final hygiene)
• Run the ConfigureExchangeHybridApplication.ps1 script in Service Principal Clean‑Up Mode to purge keyCredentials from the Office 365 Exchange Online service principal. This prevents old, potentially exploitable credentials from remaining in the shared principal. Run this only after you’ve validated the dedicated app is being used. (learn.microsoft.com, techcommunity.microsoft.com)
• Test pilot and then roll out
• Pilot the change in a test tenant or with a subset of Exchange servers; perform free/busy lookups, MailTips checks, and photo sync tests. After successful validation, roll the change out during a planned maintenance window that avoids the scheduled temporary enforcement windows.
• Monitor and rotate
• Store app certificates or secrets securely (Azure Key Vault or enterprise vault) and enforce rotation policies. Monitor Entra service principal sign‑ins and conditional access signals for anomalous activity. (learn.microsoft.com)

---

Recommended project timeline and team responsibilities​

• Week 0 (now): Inventory + stakeholder notification. Security, Exchange, infra, identity teams and change control must be informed. Tag business‑critical calendars to avoid enforcement windows causing operational pain.
• Week 1–2: Apply required Exchange HUs to all hybrid servers; validate builds.
• Week 2–3: Configure dedicated app in a pilot tenant (script All‑in‑one) or via HCW in a pilot; validate with Test‑OAuthConnectivity.
• Week 3–4: Run Service Principal Clean‑Up Mode in pilot after validation. Begin phased production rollout.
• Ongoing: Plan for Graph API migration and permission updates (prior to October 2026). (learn.microsoft.com, techcommunity.microsoft.com)

Assign clear owners:

• Exchange engineering: apply HUs, run tests, manage Setting Override.
• Identity/Entra team: oversee app registration, tenant‑wide consent, certificate storage and rotation.
• SecOps: monitor sign‑in logs, run Exchange Health Checker, and evaluate alerts from Entra sign‑in telemetry.
• Change control / comms: schedule maintenance windows outside the enforcement windows and coordinate user communication.

---

Critical analysis — strengths, operational friction, and risks​

Strengths in Microsoft’s approach​

• The dedicated app model returns control to tenants and reduces the single‑point shared trust that created the CVE risk; this is a clear security improvement. (learn.microsoft.com, cisa.gov)
• Microsoft provides both a script and HCW option, plus validation commands and cleanup modes — offering flexibility for a broad range of customers and environments. (learn.microsoft.com)
• The staged enforcement (temporary blocks first, then permanent) gives some operational leeway — when observed and planned for. The cancellation of the August window also demonstrates Microsoft’s willingness to adjust cadence based on customer feedback.

Operational frictions and risks​

• Adoption lag is real. Public telemetry and industry reporting have suggested many customers patched to supported builds but have not completed the dedicated app creation and cleanup steps; Microsoft’s temporary blocks are a blunt nudge for action. If you’re patched but haven’t created/enabled the dedicated app, you remain exposed to the enforcement windows and, for CVE risk, to an attack path.
• Human error risk. The identity changes are delicate. Mistakes in consent grants, misconfigured permissions, or premature cleanup of the shared principal before validation can break hybrid features and cause user disruption. HCW does not perform cleanup or enable the feature automatically; that manual step is a frequent source of mistakes. (learn.microsoft.com, techcommunity.microsoft.com)
• Secret management responsibility shifts. Tenant‑managed app credentials are now a customer responsibility; organizations with weak secret management or infrequent rotation policies may actually increase their blast radius unless policies are enforced. (learn.microsoft.com)
• Third‑party and automation breakage. Any third‑party tools or scripts that relied on the shared principal may fail unless updated to use the dedicated app or to use delegated flows. Inventory and update automation as part of this project.

---

Red‑flag checks and things to avoid​

• Do not clean up the shared service principal before you confirm the dedicated app is being used and tokens show up in Entra sign‑in logs for the new app. Cleaning too early is an easy way to cause avoidable outages. (learn.microsoft.com, techcommunity.microsoft.com)
• Don’t rely on a single person to approve tenant‑wide consent — implement an auditable approval workflow for admin consent and document who granted it and why. HCW and the script require tenant‑wide consent as part of the process. (techcommunity.microsoft.com)
• If you run the HCW path, remember it does not automatically create the Setting Override; add the New‑SettingOverride step to your runbook or use the script’s All‑in‑one mode instead. Missing this step is a common oversight. (learn.microsoft.com, techcommunity.microsoft.com)

---

What we don’t know (and what to watch): unverifiable or evolving items​

• Counts of how many tenants remain unconverted vary across community research and are time‑sensitive; third‑party tallies of unpatched or unconverted servers (for example, community reports estimating tens of thousands of vulnerable servers) change daily and should be treated as snapshot telemetry rather than immutable facts. Treat such numbers as operational signals — not absolutes — and verify with your own inventory.
• The exact timing and duration of any future temporary blocks beyond the announced windows could change; Microsoft has already adjusted the August window. Maintain a watch on Microsoft’s message center posts and the Exchange team blog for updates. (techcommunity.microsoft.com)

---

Executive summary for IT leadership (concise)​

• This is an identity and hybrid trust hardening effort that requires immediate action: apply April 2025 hotfixes, create/enable the dedicated Exchange hybrid app in Entra ID, validate OAuth token acquisition, and then run the Service Principal Clean‑Up Mode to rotate/remove shared principal credentials. Failure to do so risks temporary user impact during scheduled EWS blocks (September 16 and October 7, 2025) and permanent loss of rich coexistence features after October 31, 2025. (techcommunity.microsoft.com, learn.microsoft.com)
• Assign cross‑functional ownership (Exchange, Identity, SecOps), schedule the work in maintenance windows outside temporary enforcement windows, and use the provided Microsoft validation commands and Entra sign‑in logs to confirm success before cleanup. (learn.microsoft.com, techcommunity.microsoft.com)

---

Final takeaways and recommended next steps (actionable)​

• Inventory now. If you run hybrid Exchange with rich coexistence, assume you’re affected until proven otherwise. Use Exchange Health Checker and Entra sign‑in logs to build proof.
• Patch now. Install the April 2025 HU or newer that brings your Exchange servers to the required minimum builds. (learn.microsoft.com)
• Configure the dedicated app now. Prefer the script in All‑in‑one mode for a guided, auditable path — pilot first, then production. If you use HCW, be prepared to run New‑SettingOverride manually. (learn.microsoft.com, techcommunity.microsoft.com)
• Validate first, clean up second. Confirm token acquisition and Entra sign‑in activity for the new app before you remove keyCredentials from the shared principal. (learn.microsoft.com)
• Monitor and harden afterward. Enforce secret rotation, secure certificate storage, and alert on anomalous service principal sign‑in patterns. (learn.microsoft.com)

The security rationale is sound — moving from a Microsoft‑managed shared identity to tenant‑owned application identities reduces systemic risk — but the migration is nontrivial and timing matters. The August enforcement cancellation buys organizations breathing room, but the September and October test windows and the permanent block at the end of October are firm: the time for planning and action is now.

---

Source: Microsoft Exchange Team Blog https://techcommunity.microsoft.com/t5/exchange-team-blog/dedicated-hybrid-app-temporary-enforcements-new-hcw-and-possible/ba-p/4440682/