Exchange Connection Problems

How to Enable External Access to On-Premises Email in a Hybrid Environment

Amos Gikunda Oct 9, 2026 868 views

Question details

The user needs to allow external webmail access without a VPN for temporary employees using on-premises email in a hybrid setup.

How to Enable External Access to On-Premises Email in a Hybrid Environment

Product: Microsoft Exchange
Device & OS: not provided
Scenario: An organization uses a hybrid environment where permanent employees use Microsoft 365, while temporary staff use on-premises email servers and require remote access.
Observed behavior: Temporary staff are currently restricted to accessing webmail only from the internal corporate network unless they use a VPN.

Before you start

Configuring external access in a hybrid Exchange environment requires network security adjustments and specialized administrative privileges. Ensure you have IT administrator credentials before making any server-level changes.

Solution 1Recommended

Consult Microsoft Q&A for IT Professionals

Because exposing on-premises email to the internet involves complex network security and reverse proxy configurations, it is highly recommended to seek specialized administrator assistance.

Publishing on-premises webmail (OWA) to external networks requires configuring a reverse proxy or Web Application Proxy (WAP) to protect the corporate network. This process falls outside standard user settings and requires Microsoft Exchange administrative expertise.

Document your environment

Collect details about your on-premises Exchange Server version, network topology, and current Microsoft 365 hybrid configuration status.

Navigate to Microsoft Q&A

Open your web browser and visit the official Microsoft Q&A community forums.

Post in the appropriate category

Submit a detailed question regarding securely publishing external webmail access, ensuring you tag it under 'Outlook for IT professionals' or 'Exchange Server' for expert engineering support.

Consult local Exchange administrators

Work directly with your internal network administrators to securely publish the Outlook on the Web (OWA) URL through a Web Application Proxy, eliminating the need for a VPN.

Consult Microsoft Q&A for IT Professionals

Security Warning: Never expose internal Exchange servers directly to the open internet without an enterprise-grade secure reverse proxy or firewall configuration.

Free Microsoft Office alternative

Enhance Your Daily Workflow with WPS Office

While server-side Exchange hybrid configurations require specialized Microsoft IT administration, WPS Office offers a free, lightweight, and highly compatible alternative for handling your everyday documents, spreadsheets, and presentations.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Includes integrated mail client features for managing your daily emails efficiently.Free, lightweight, and runs smoothly on both older and modern devices.Familiar user interface allowing for seamless migration with no learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

Why do on-premises email users need a VPN for remote access?

If an organization has not securely published Outlook on the Web (OWA) or Outlook Anywhere to the external internet via a reverse proxy, the email server remains confined to the internal network. A VPN is then required to bridge the user's remote device to that internal network.

Can on-premises users and Microsoft 365 users share the same domain?

Yes. In a properly configured Exchange hybrid environment, both on-premises users and cloud users can share the same email domain, calendar free/busy information, and global address list.

How do IT administrators typically publish OWA for external access?

Administrators generally use a Web Application Proxy (WAP), Azure AD Application Proxy, or a third-party load balancer and reverse proxy to safely publish the internal OWA URL to the external internet without exposing the actual server.

Outlook & Email Problems