In an Exchange hybrid organisation that synchronises users from Active Directory, on-premises Exchange is still where cloud mailboxes are created and where most of their attributes are edited. Get it wrong and you end up with mail that loops, addresses you can't change and mailboxes you can't move. In this post I'll show the supported way to create and manage remote mailboxes, the attributes that make them work, and how to fix the most common mistakes.
Errors this guide fixes
550 5.1.10 "recipient not found"NDR (Exchange Online)
How remote mailboxes work#
A remote mailbox is an on-premises mail-enabled user that represents a mailbox in Exchange Online. Active Directory stays the source of authority: you create the object on-premises, directory synchronisation copies it to Microsoft Entra ID, and Exchange Online provisions the mailbox once the user is licensed. On-premises Exchange routes mail for that user to its remote routing address in the tenant's coexistence domain (contoso.mail.onmicrosoft.com), which travels over the hybrid send connector.
These are the Active Directory attributes behind it. Read them with Get-RemoteMailbox rather than editing them by hand.
| Attribute | Typical value | Why it matters |
|---|---|---|
msExchRecipientTypeDetails | 2147483648 (RemoteUserMailbox); 34359738368 shared, 8589934592 room, 17179869184 equipment | Tells Exchange Online which kind of mailbox to provision |
msExchRemoteRecipientType | 1 (ProvisionMailbox) for mailboxes created in the cloud, 4 (Migrated) for mailboxes moved from on-premises; 3 or 6 when a cloud archive was provisioned too | Shows how the mailbox came to be in the cloud |
targetAddress | SMTP:sara.ali@contoso.mail.onmicrosoft.com | The RemoteRoutingAddress: where on-premises Exchange sends the user's mail |
proxyAddresses | Must include smtp:sara.ali@contoso.mail.onmicrosoft.com | Lets Exchange Online accept mail sent to the routing address |
msExchMailboxGuid | The ExchangeGuid; all zeros for a mailbox created in the cloud until you stamp it | Must match the cloud mailbox before it can be moved back on-premises |
Prerequisites#
- Hybrid configured with the Hybrid Configuration Wizard (HCW), so the coexistence domain exists as a remote domain and in your email address policy.
- Directory synchronisation with the Exchange hybrid option enabled.
- Exchange Server Subscription Edition (SE) or the SE management tools. Exchange 2016 and 2019 reached end of support on 14 October 2025.
- Recipient management permissions on-premises, and Exchange Online PowerShell V3 for the checks.
Check the routing domain first:
Get-EmailAddressPolicy | Format-List Name, EnabledEmailAddressTemplates
Get-RemoteDomain | Where-Object TargetDeliveryDomain | Format-List Name, DomainNameGood looks like: every policy that applies to cloud users lists smtp:%m@contoso.mail.onmicrosoft.com. The HCW adds it to the default policy only, so check any extra policies yourself.
Step-by-step: create and manage remote mailboxes#
1. A new user who needs a cloud mailbox#
Create the AD account and the remote mailbox in one go, either in the Exchange admin center (Recipients › Mailboxes › New › Office 365 mailbox) or in the Exchange Management Shell:
New-RemoteMailbox -Name "Sara Ali" -FirstName Sara -LastName Ali `
-UserPrincipalName sara.ali@contoso.com `
-OnPremisesOrganizationalUnit "contoso.com/Staff" `
-Password (Read-Host "Initial password" -AsSecureString) -ResetPasswordOnNextLogon $true2. An existing AD user#
Enable-RemoteMailbox -Identity sara.ali -RemoteRoutingAddress sara.ali@contoso.mail.onmicrosoft.comAdd -Shared, -Room or -Equipment for other mailbox types (-Shared needs Exchange 2016 CU10 or later plus setup.exe /PrepareAD, which any SE organisation already has). To give an existing cloud mailbox an archive, run Enable-RemoteMailbox -Identity sara.ali -Archive.
3. Synchronise and license#
Wait for the next sync cycle or run Start-ADSyncSyncCycle -PolicyType Delta on the Entra Connect server. Then set a usage location and assign a licence that includes Exchange Online (group-based licensing works well). Shared, room and equipment mailboxes normally don't need a licence.
4. Stamp the ExchangeGuid back on-premises#
A mailbox created in the cloud has an empty ExchangeGuid on-premises. Copy the real one across now, so a future move back on-premises doesn't fail:
# Exchange Online PowerShell
Get-Mailbox sara.ali@contoso.com | Format-List ExchangeGuid, ArchiveGuid
# Exchange Management Shell (on-premises)
Set-RemoteMailbox sara.ali -ExchangeGuid "<ExchangeGuid from Exchange Online>"If the user has a cloud archive, set -ArchiveGuid the same way. Mailboxes migrated with a hybrid move already have matching GUIDs.
5. Make everyday changes in the right place#
| Change | Where | How |
|---|---|---|
| Email addresses, primary SMTP, alias | On-premises | Set-RemoteMailbox -EmailAddresses, -PrimarySmtpAddress |
| Display name, hide from address lists | On-premises | Set-RemoteMailbox -DisplayName, -HiddenFromAddressListsEnabled |
| Convert to a shared mailbox | Both | Set-Mailbox -Type Shared in Exchange Online, then Set-RemoteMailbox -Type Shared on-premises |
| Quotas, holds, retention, calendar processing, Full Access | Exchange Online | Set-Mailbox, Set-CalendarProcessing, Add-MailboxPermission |
If you try to change a synced attribute in Exchange Online, the command fails with a message saying the object is being synchronised from your on-premises organisation. That is by design: make the change on-premises.
Verify#
# On-premises
Get-RemoteMailbox sara.ali | Format-List RecipientTypeDetails, RemoteRecipientType, RemoteRoutingAddress, ExchangeGuid, EmailAddresses
# Exchange Online
Get-Mailbox sara.ali@contoso.com | Format-List RecipientTypeDetails, IsDirSynced, ExchangeGuid, EmailAddressesGood looks like:
- On-premises:
RemoteUserMailbox(orRemoteSharedMailbox),ProvisionMailboxorMigrated, and a RemoteRoutingAddress incontoso.mail.onmicrosoft.com. - Exchange Online:
UserMailbox(orSharedMailbox),IsDirSynced : True, and the coexistence address listed in EmailAddresses. - The ExchangeGuid is identical on both sides and isn't all zeros.
- A test message from an on-premises mailbox arrives, and message trace shows it entering Exchange Online through the hybrid connector.
Tips and gotchas: the common mistakes#
Creating the mailbox in the cloud first#
If you license a synced user who isn't mail-enabled on-premises, Exchange Online creates a mailbox anyway, but on-premises Exchange knows nothing about it. On-premises senders and relaying applications can't reach the user, and you can't edit the addresses from either side without touching raw AD attributes. Fix it by running Enable-RemoteMailbox with the correct RemoteRoutingAddress, then stamping the ExchangeGuid. If the user also has an on-premises mailbox, you now have two mailboxes and mail splits between them; decide which one survives and export data before you remove the other. Microsoft's documented clean-up of the cloud copy uses Set-User -PermanentlyClearPreviousMailboxInfo in Exchange Online, which can't be undone.
The wrong RemoteRoutingAddress#
Pointing it at the primary domain (sara.ali@contoso.com) makes Exchange route the message back to itself until it gives up with a loop NDR. Using the contoso.onmicrosoft.com domain sends mail outside the hybrid connector. Always use the mail.onmicrosoft.com domain:
Set-RemoteMailbox sara.ali -RemoteRoutingAddress sara.ali@contoso.mail.onmicrosoft.comMissing coexistence proxy address#
Users with EmailAddressPolicyEnabled set to $false don't get the coexistence address automatically, so mail routed to it is rejected by Exchange Online with a 550 5.1.10 "recipient not found" NDR. Add it with Set-RemoteMailbox sara.ali -EmailAddresses @{Add="smtp:sara.ali@contoso.mail.onmicrosoft.com"}.
Using Disable-RemoteMailbox as a reset#
Disable-RemoteMailbox removes the cloud mailbox while keeping the on-premises user. Treat it as a delete, not a repair.
Planning to retire your last server? See removing the last Exchange server in hybrid. For shared mailbox access across environments, see cross-premises permissions.
