Security Policy Errors

Is Exchange Extended Protection Required in a Hybrid Environment?

Maira Mehtab Oct 1, 2026 869 views

Question details

Determine whether Exchange Extended Protection is required for Exchange Server 2016 when all mailboxes have been migrated to Exchange Online but classic hybrid connectivity remains.

Is Exchange Extended Protection Required in a Hybrid Environment?

Product: Microsoft Exchange Server
Device & OS: not provided
Scenario: Securing on-premises Exchange servers after migrating mailboxes to the cloud in a classic hybrid environment.
Observed behavior: Seeking best practice confirmation on whether to enable Extended Protection despite having no active on-premises mailboxes.

Before you start

Verify that your Exchange Server 2016 is running on a supported Cumulative Update (CU) and that your SSL bridging and TLS configurations meet Microsoft's prerequisites before enabling Extended Protection.

Solution 1Recommended

Enable Extended Protection for Exchange Server

Enabling Extended Protection is highly recommended for all hybrid environments, even if mailboxes are migrated, to secure the server against man-in-the-middle attacks.

While your mailboxes are hosted in Exchange Online, your on-premises Exchange 2016 servers still handle authentication processes and maintain classic hybrid connectivity. Leaving these servers without Extended Protection exposes them to potential man-in-the-middle (MitM) and NTLM relay attacks.

Microsoft strongly advises configuring Windows Extended Protection (EP) on all Exchange Servers where supported to ensure secure authentication.

Assess your current environment

Review Microsoft's official guidance on Exchange Server support for Windows Extended Protection to ensure your current CU and third-party applications support the feature.

Download the Microsoft script

Obtain the latest version of the ExchangeExtendedProtectionManagement PowerShell script from Microsoft's official GitHub repository.

Run the configuration script

Execute the script in the Exchange Management Shell as an administrator to automatically evaluate and apply the necessary IIS and registry configurations.

Test hybrid mail flow

After enabling the protection, thoroughly test incoming and outgoing mail flow between your on-premises environment and Exchange Online to ensure hybrid connectivity remains stable.

Enable Extended Protection for Exchange Server

Modern Hybrid Environments: If you are using the Modern Hybrid topology with the Hybrid Agent, ensure you follow specific Microsoft guidelines, as certain proxy and TLS offloading scenarios require tailored Extended Protection configurations.

Free Microsoft Office alternative

Streamline Your Office Work with WPS Office

While you manage complex backend infrastructure like Exchange Server environments, you can simplify daily productivity tasks for your team. WPS Office provides a robust, lightweight, and cost-effective alternative to Microsoft Office.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Run the Setup: Execute the installer and follow the quick on-screen instructions to deploy the software suite.
3. Start Creating: Open WPS Office and immediately start viewing, editing, or creating documents with full Microsoft format compatibility.

Seamless compatibility with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight architecture that consumes minimal system resources and installs rapidly.Familiar tabbed user interface, requiring zero retraining for employees transitioning from other software.Built-in advanced PDF editing, conversion, and security features at no extra cost.

microsoft office alternative - wps office

Frequently Asked Questions

What happens if I do not enable Extended Protection on my hybrid Exchange servers?

Without Extended Protection, your on-premises Exchange servers remain vulnerable to NTLM relay and man-in-the-middle attacks, which could allow attackers to intercept authentication traffic and compromise your environment.

Does enabling Extended Protection break classic hybrid mail flow?

No, if configured correctly using Microsoft's prerequisites and management scripts, Extended Protection will not disrupt classic hybrid connectivity. You must ensure SSL certificates and TLS settings are properly configured across all endpoints.

Which versions of Exchange Server support Extended Protection?

Extended Protection is supported on Exchange Server 2013 (CU23 with specific security updates), Exchange Server 2016 (CU22 or later), and Exchange Server 2019 (CU11 or later). Running unsupported versions will result in authentication failures if enabled.

Microsoft Office Security Issues