Cloud-based management of Exchange attributes for Remote Mailboxes in hybrid environments

2025-10-15

Overview

In an Exchange Hybrid environment, the management of Exchange attributes for directory-synchronized users is restricted in Exchange Online (EXO). Organizations are required to utilize their on-premises Exchange Server, sometimes referred as Last Exchange Server (LES), to modify these attributes within Active Directory (AD), synchronizing any changes to the cloud through Cloud Sync or Connect Sync. As a result, although mailboxes are located in the cloud, organizations remain dependent on their on-premises Exchange Server for managing cloud mailboxes by executing Exchange Server cmdlets that update on-premises Active Directory, which then synchronizes the updates to the cloud.

A new capability in Exchange Online now allows administrators to manage Exchange attributes for directory-synchronized users with mailboxes hosted in the cloud. With this update, the Source of Authority (SOA) for Exchange-specific attributes can be transferred to the cloud, while the SOA for identity-related attributes remains under the control of the on-premises Active Directory. After moving the SOA for Exchange attributes to the cloud, these details can be managed using EXO PowerShell, the Microsoft 365 Admin Centre, or the Exchange Admin Centre, whereas identity attributes are still modified through on-premises Active Directory only. This document provides detailed instructions for activating this feature for users whose mailboxes are located in the cloud, as well as the process of shifting the SOA for Exchange attributes to the cloud environment.

After a user's Exchange attribute SOA is transferred to the cloud, editing the user's first name and last name requires using on-premises Active Directory. To modify Exchange attributes such as HiddenFromAddressListsEnabled or CustomAttribute(x), administrators need to use Exchange Online PowerShell or Microsoft 365 Exchange Admin Center (EAC).

We will offer functionality to synchronize updates to essential Exchange attributes, such as proxyAddresses, CustomAttributes(1-15), extensionAttribute(1-5), RecipientType, and others, back to the on-premises Active Directory.

Feature Availability

Note

Currently, this feature is only available for customers in the Microsoft 365 worldwide (commercial) cloud. Information about availability in other cloud environments will be provided at a later date

Microsoft is providing this feature in two phases:

Phase 1 (now GA) introduces per-mailbox control for cloud management of Exchange attributes. Administrators can opt in individual mailboxes for cloud management by setting IsExchangeCloudManaged to true. During this phase, mailboxes may also be rolled back to on-premises management if required (IsExchangeCloudManaged set back to false). Phase 1 is intended for managing existing user mailbox attributes individually and for feature validation.

Phase 2 will introduce write-back support for designated attributes, as well as Entra Cloud Sync integration. During this phase, modifications to key Exchange properties made in the cloud will be automatically synchronized to on-premises Active Directory. This process ensures that your on-premises AD is consistently updated; for instance, any changes to a proxy address in Exchange Online will be reflected accordingly. To utilize writeback functionality, customers are required to implement Entra Cloud Sync. Additional information regarding this capability will be shared as part of the documentation once phase 2 is about to start.

We are in the process of developing Object-Level SOA management for Users, Groups, and Contacts. This functionality is intended to assist organizations seeking to decommission both on-premises Exchange Servers and Active Directory. With this feature, the SOA of individual objects - such as Users, Groups, and Contacts- can be migrated to the cloud at the object level. Comprehensive support for User SOA, Group SOA, and Contact SOA will enable full cloud-based management of entities originally created on-premises, once migration is complete. Although User and Contacts SOA are not yet available, Group SOA - which enables you to migrate the SOA of an entire group to the cloud - is now available for you to try.

Identity, Exchange Attributes and Writeback

The following table contains a comprehensive table detailing which attributes can be edited following the Exchange Attribute SOA transfer and whether these updates will be written back to the on-premises Active Directory after the SOA transfer.

No.	Attribute	Type	Can be edited in EXO	Writeback to On-prem	Cmdlet to modify	Parameter
1	accountEnabled	Identity	No
2	C	Identity	No
3	Cn	Identity	No
4	Co	Identity	No
5	company	Identity	No
6	countryCode	Identity	No
7	department	Identity	No
8	displayName	Identity	No
9	facsimiletelephonenumber	Identity	No
10	givenName	Identity	No
11	homePhone	Identity	No
12	info	Identity	No
13	Initials	Identity	No
14	l	Identity	No
15	mailNickname	Identity	No
16	manager	Identity	No
17	mobile	Identity	No
18	msDS-HABSeniorityIndex	Identity	No
19	msDS-PhoneticDisplayName	Identity	No
20	objectSID	Identity	No
21	otherFacsimileTelephone	Identity	No
22	otherHomePhone	Identity	No
23	otherTelephone	Identity	No
24	pager	Identity	No
25	physicalDeliveryOfficeName	Identity	No
26	postalCode	Identity	No
27	pwdLastSet	Identity	No
28	sn	Identity	No
29	sourceAnchor	Identity	No
30	st	Identity	No
31	streetAddress	Identity	No
32	telephoneAssistant	Identity	No
33	telephoneNumber	Identity	No
34	title	Identity	No
35	usageLocation	Identity	No
36	userPrincipalName	Identity	No
37	wWWHomePage	Identity	No
38	altRecipient	Exchange	Yes	No	Set-Mailbox	ForwardingAddress
39	authoring	Exchange	Yes	No	Set-Mailbox	AcceptMessagesOnlyFrom
40	dLMemRejectPerms	Exchange	Yes	No	Set-Mailbox	RejectMessagesFromDLMembers
41	dLMemSubmitPerms	Exchange	Yes	No	Set-Mailbox	AcceptMessagesOnlyFromDLMembers
42	extensionAttribute1	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute1
43	extensionAttribute10	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute10
44	extensionAttribute11	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute11
45	extensionAttribute12	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute12
46	extensionAttribute13	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute13
47	extensionAttribute14	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute14
48	extensionAttribute15	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute15
49	extensionAttribute2	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute2
50	extensionAttribute3	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute3
51	extensionAttribute4	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute4
52	extensionAttribute5	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute5
53	extensionAttribute6	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute6
54	extensionAttribute7	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute7
55	extensionAttribute8	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute8
56	extensionAttribute9	Exchange	Yes	Yes	Set-Mailbox	CustomAttribute9
57	legacyExchangeDN	Exchange	Yes	No	Not editable in cloud by default.
58	mail	Exchange	Yes	No	Set-Mailbox	WindowsEmailAddress
59	msExchArchiveGUID	Exchange	Yes	No	Enable-Mailbox	Archive
60	msExchArchiveName	Exchange	Yes	No	Set-Mailbox	ArchiveName
61	msExchAssistantName	Exchange	Yes	No	Set-User	AssistantName
62	msExchAuditAdmin	Exchange	Yes	No	Set-Mailbox	AuditAdmin
63	msExchAuditDelegate	Exchange	Yes	No	Set-Mailbox	AuditDelegate
64	msExchAuditDelegateAdmin	Exchange	Yes	No	Set-Mailbox	AuditDelegate
65	msExchAuditOwner	Exchange	Yes	No	Set-Mailbox	AuditOwner
66	msExchBlockedSendersHash	Exchange	Yes	No	Set-MailboxJunkEmailConfiguration	BlockedSendersAndDomains
67	msExchBypassAudit	Exchange	Yes	No	Set-MailboxAuditBypassAssociation	AuditBypassEnabled
68	msExchDelegateListLink	Exchange	Yes	No	Add-MailboxPermission	AccessRights, User, InheritanceType
69	msExchELCExpirySuspensionEnd	Exchange	Yes	No	Set-Mailbox	EndDateForRetentionHold
70	msExchELCExpirySuspensionStart	Exchange	Yes	No	Set-Mailbox	StartDateForRetentionHold
71	msExchELCMailboxFlags	Exchange	Yes	No	Set-Mailbox	SingleItemRecoveryEnabled, LitigationHoldEnabled, RetentionHoldEnabled,
72	msExchEnableModeration	Exchange	Yes	No	Set-Mailbox	ModerationEnabled
73	msExchExtensionCustomAttribute1	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute1
74	msExchExtensionCustomAttribute2	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute2
75	msExchExtensionCustomAttribute3	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute3
76	msExchExtensionCustomAttribute4	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute4
77	msExchExtensionCustomAttribute5	Exchange	Yes	Yes	Set-Mailbox	ExtensionCustomAttribute5
78	msExchHideFromAddressLists	Exchange	Yes	No	Set-Mailbox	HiddenFromAddressListsEnabled
79	msExchImmutableID	Exchange	Yes	No	Set-Mailbox	ImmutableId
80	msExchLitigationHoldDate	Exchange	Yes	No	Set-Mailbox	LitigationHoldDate
81	msExchLitigationHoldOwner	Exchange	Yes	No	Set-Mailbox	LitigationHoldOwner
82	msExchMailboxAuditEnable	Exchange	Yes	No	Set-Mailbox	AuditEnabled
83	msExchMailboxAuditLogAgeLimit	Exchange	Yes	No	Set-Mailbox	AuditLogAgeLimit
84	msExchMailboxGuid	Exchange	Yes	No	Not editable in cloud by default.
85	msExchModeratedByLink	Exchange	Yes	No	Set-Mailbox	ModeratedBy
86	msExchModerationFlags	Exchange	Yes	No	Set-Mailbox	SendModerationNotifications, ByPassModerationFromSendersOrMembers, ModerationEnabled
87	msExchRecipientDisplayType	Exchange	Yes	Yes	Set-Mailbox	Type
88	msExchRecipientTypeDetails	Exchange	Yes	Yes	Set-Mailbox	Type
89	msExchRemoteRecipientType	Exchange	Yes	No	Set-Mailbox	RemoteRecipientType
90	msExchRequireAuthToSendTo	Exchange	Yes	No	Set-Mailbox	RequireAllSendersAreAuthenticated
91	msExchResourceCapacity	Exchange	Yes	No	Set-Mailbox	ResourceCapacity
92	msExchResourceDisplay	Exchange	Yes	No	Set-Mailbox	ResourceCustom
93	msExchResourceMetaData	Exchange	Yes	No	Set-Mailbox	ResourceCustom
94	msExchResourceSearchProperties	Exchange	Yes	No	Set-Mailbox	ResourceCustom
95	msExchRetentionComment	Exchange	Yes	No	Set-Mailbox	RetentionComment
96	msExchRetentionURL	Exchange	Yes	No	Set-Mailbox	RetentionUrl
97	msExchSafeRecipientsHash	Exchange	Yes	No	Set-MailboxJunkEmailConfiguration	Reserved for internal use
98	msExchSafeSendersHash	Exchange	Yes	No	Set-MailboxJunkEmailConfiguration	TrustedSendersAndDomains
99	msExchSenderHintTranslations	Exchange	Yes	No	Set-Mailbox	MailTipTranslations
100	msExchUserHoldPolicies	Exchange	Yes	No	Set-Mailbox	LitigationHoldEnabled
101	proxyAddresses	Exchange	Yes	Yes	Set-Mailbox	EmailAddresses and WindowsEmailAddress
102	publicDelegates	Exchange	Yes	No	Set-Mailbox	GrantSendOnBehalfTo
103	unauthOrig	Exchange	Yes	No	Set-Mailbox	RejectMessagesFrom
104	userCertificate	Exchange	Yes	No	Set-Mailbox	UserCertificate
105	userSMIMECertificates	Exchange	Yes	No	Set-Mailbox	UserSMimeCertificate

Prerequisites

Before transferring the SOA from on-premises to Exchange Online, certain prerequisites must be met.

Microsoft Entra Connect version

To enable this feature, install the latest version of Entra Connect Sync. Download and install version 2.5.76.0 or higher of the Entra Connect Sync build prior to use. For detailed instructions on upgrading from older versions, refer to the Microsoft Entra Connect: Upgrade from a previous version to the latest documentation. If you use an older version of Entra Connect Sync than 2.5.76.0, the sync client will try to push Exchange attributes of already SOA transferred mailboxes to Entra ID but will fail. Upgrading to newer version will resolve this issue.

To confirm successful installation of the Entra Connect Sync build, navigate to Programs within the Control Panel and verify that the Microsoft Entra Connect Sync version is 2.5.76.0 or higher. Alternatively, this information may be obtained using PowerShell:

(Get-ADSyncGlobalSettings).Parameters['Microsoft.Synchronize.ServerConfigurationVersion']

Role requirements

By default, the IsExchangeCloudManaged parameter in Set-Mailbox is available to administrators with roles such as Organization Management, Recipient Management, or any custom roles derived from these. The Entra ID role Exchange Administrator also provides access to Exchange RBAC roles that include this parameter. Anyone with Exchange Administrator permissions can run Set-Mailbox -IsExchangeCloudManaged unless the parameter is specifically removed from their RBAC roles.

To manage access to this parameter, organizations should determine which roles provide access, remove the parameter from broad role groups, and create custom roles that grant or deny IsExchangeCloudManaged according to business requirements.

How to transfer Exchange attributes SOA to the cloud

A new parameter, IsExchangeCloudManaged, has been added for Exchange Online users. This property indicates whether a directory-synchronized user's Exchange attributes are managed in the cloud or on-premises. By default, the IsExchangeCloudManaged value is set to false. Note that this parameter is applicable only to mailboxes with a user whose IsDirSynced status is true. It should not be used together with any other parameters.

Important

After updating dir-synced users' mailbox attributes on-premises with Set-RemoteMailbox, allow for the usual Connect Sync cycle plus 24 hours before switching Exchange attributes to Cloud Managed. For example, if your sync takes 6 hours, wait 30 hours in total.

To configure Exchange attributes for a directory-synchronized user's mailbox to be managed in the cloud, change the user's parameter value to true. To accomplish this, open an Exchange Online PowerShell session and execute the following command for a mailbox that is located in the cloud.

Set-Mailbox -Identity <User> -IsExchangeCloudManaged $true

The status of this change can be verified by executing the following cmdlet:

Get-Mailbox -Identity <User> | Format-List Identity, IsExchangeCloudManaged

When IsExchangeCloudManaged is set to true for a mailbox synced via Entra Connect Sync, Exchange Attributes stop updating from on-premises. You can then edit these attributes directly in the cloud, which was previously restricted.

Set-Mailbox -Identity <User> -CustomAttribute1 "ModifiedInTheCloud"

To find all users whose Exchange attribute SOA has been transferred to the cloud, retrieve the accounts where the IsExchangeCloudManaged property is set to true. You can use the following command:

Get-Mailbox | Where-Object { $_.IsDirSynced -eq $true -and $_.IsExchangeCloudManaged -eq $true }

How to transfer Exchange attributes SOA back to on-premises

To change the management of a user's Exchange attributes from cloud-managed to on-premises-managed, set IsExchangeCloudManaged to false. After this setting is updated, the next synchronization cycle will update the user's cloud Exchange attributes with the values from the on-premises environment.

Prior to implementing this change, ensure that any modifications made in the Cloud which must be retained in the on-premises Active Directory are properly backed up. Utilize cmdlets such as Get-Mailbox and Get-User to save relevant values, allowing for manual restoration to the on-premises environment when required.

The following command transfers the SOA for a mailbox back to on-premises-managed:

Set-Mailbox -Identity <User> -IsExchangeCloudManaged $false

How to create new mailboxes

New mailboxes may continue to be created using the on-premises New-RemoteMailbox cmdlet, which provisions mailboxes in the cloud, until the final Exchange Server is decommissioned or shut down. However, as the objective of this feature is to accelerate the decommissioning process for the last Exchange Server, the recommended approach for creating new mailboxes is outlined here:

Create an Active Directory user in the on-premises environment and assign the required identity attributes. If a custom source anchor is used, ensure the property is assigned in the on-premises Active Directory.
Entra Connect Sync will then synchronize the identity to the cloud.
Use the Microsoft 365 Admin Center to assign an Exchange Online license to the user. This action provisions a mailbox in Exchange Online.
Finally, use Set-Mailbox to set IsExchangeCloudManaged to true. This transfers the SOA for this user to the cloud.

How to delete an existing mailbox

To delete a user and their mailbox, the process requires removing the user from on-premises Active Directory, even if the attributes are managed in the cloud. When the deletion is synchronized to the cloud through Entra Connect Sync, the user's mailbox is also deleted from the cloud.

Frequently Asked Questions

❓ What will happen if I try to offboard (migrate) user's mailbox to on-premises while IsExchangeCloudManaged is true?

To offboard a mailbox from the cloud, set IsExchangeCloudManaged to false before migration. Offboarding when this attribute is true will break synchronization between on-premises Active Directory and Entra, because Exchange attributes will be treated as cloud-managed, blocking updates from on-premises.

❓ Is this feature currently available for environments that use only Entra Cloud Sync in a hybrid setup?

At this stage, the feature is available exclusively through Entra Connect Sync. Future updates will include support for writeback and Entra Cloud Sync.

❓ I use an IDM solution, is this feature applicable for me?

Yes, this feature is applicable for you. Organizations that using third-party IDM solutions are advised to confirm with their vendor regarding current or future support for this feature.

Share via