'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Exchange 2019 to Exchange Online Migration 403 Errors
Question details
The user needs to resolve a 403 Forbidden error that occurs during a hybrid mailbox migration from Exchange 2019 to Exchange Online.
- Product
- Microsoft Exchange
- Device & OS
- not provided
- Scenario
- Migrating mailboxes from an on-premises Exchange 2019 server to Exchange Online in a hybrid deployment setup.
- Observed behavior
- The migration fails with a 403 Forbidden error when attempting to access the EWS MRS Proxy endpoint, despite diagnostic tools indicating the proxy is enabled.
Ensure you have full administrative access to your on-premises Exchange 2019 server and IIS Manager before modifying authentication settings.
Verify IIS Authentication and MRS Proxy Configuration
Check your on-premises Exchange server's IIS settings to ensure the correct authentication methods are enabled for the EWS virtual directory.
A 403 Forbidden error typically indicates a permissions or authentication mismatch on the server side. Even if the MRS Proxy appears enabled in HealthChecker, IIS might be blocking the request due to incorrect authentication configurations.
Log in to your on-premises Exchange 2019 server and open the Internet Information Services (IIS) Manager.
Navigate to 'Default Web Site' > 'EWS' and open the 'Authentication' feature. Verify that 'Anonymous Authentication' and 'Windows Authentication' are configured according to Microsoft's hybrid deployment prerequisites.
Open a Command Prompt as Administrator and run 'iisreset' to apply any configuration changes you have made to the IIS settings.
Consult Microsoft Q&A for Hybrid Deployments
Escalate complex on-premises server configurations to Microsoft specialists if standard IIS troubleshooting does not resolve the issue.
Looking for a Lightweight Alternative to Microsoft Office?
While troubleshooting complex Microsoft Exchange server migrations, you might be looking for ways to reduce IT overhead. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office suites, offering robust tools for documents, spreadsheets, and presentations without the heavy deployment requirements.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen prompts to set up WPS Office on your device in just a few minutes.
- 3. Open Existing MS Office Files: Launch WPS Office and directly open your existing Word, Excel, and PowerPoint documents with full formatting retention.
Frequently Asked Questions
What causes a 403 Forbidden error during Exchange hybrid migrations?
This error typically occurs due to incorrect IIS authentication settings, permissions issues on the EWS virtual directory, or misconfigured MRS Proxy endpoints on the on-premises Exchange server.
How can I verify if the MRS Proxy is enabled on my Exchange server?
You can verify the MRS Proxy status by running the Microsoft Exchange HealthChecker script or by checking the EWS virtual directory settings in the Exchange Admin Center (EAC) under Servers > Virtual Directories.
Do I need an active Microsoft support plan to post on Microsoft Q&A?
No, Microsoft Q&A is a free community platform where users, MVPs, and Microsoft engineers assist with technical issues like Exchange hybrid deployments.
Can I restart IIS without affecting my Exchange users?
Running an iisreset will briefly disconnect connected clients (like Outlook) and interrupt web services (like OWA or EWS), so it is best performed during a scheduled maintenance window.
