(550 5.7.64 TenantAttribution Relay Access Denied SMTP) error when users send mail externally in Of.Īdd all domains, whether custom tenant SMTP domains or tenant coexistence domains as Accepted Domains into your Exchange On-Premises Organization using the Exchange Control Panel (ECP) or Exchange PowerShell.Ĭreate a separate Email Address Policy for each tenant/OU pair.To know more about message attribution, please refer to the following articles: The Certificate that will be used by a Send Connector is controlled by the TlsCertificateName parameter. If same certificate is used, then the email to one tenant may attribute to the other tenant. Separate Certificate for each Send connector sending to each tenantįor proper email attribution to each tenant, make sure you are using separate certificate for each Send connector sending to each tenant.

(Don't cross the streams!)įor additional information about supported topologies for Azure AD Connect take a look at this page You can of course synchronize multiple on-premises OU’s to the same tenant, there are many ways to set this up based upon your local AD, but the hard rule is not to overlap the scope of these synchronization relationships, which will ensure on-premises users are associated with only one cloud tenant. You’ll end up with a sync topology that will be similar to the following: You must also ensure that 'Exchange Hybrid' checkbox is selected in Optional Features while configuring directory sync for each tenant. Users in the on-premises Active Directory must not be synchronized to more than one tenant, and so Azure AD Connect must be configured using the Domain/OU filtering option to filter users from your on-premises directory to ensure they appear only in a single online Exchange tenant.

The updated version of Hybrid Configuration Wizard requires Exchange Server 2016, CU18 or higher or Exchange Server 2019, CU7 or higher to enable this functionality. You can download the HCW version supporting this feature from aka.ms/hybridwizard. You can refer to this article for setting it up if you require it.

In this release we allow admins to enable Hybrid deployment with up to 5 tenants simultaneously.įree/Busy configuration between tenants is not available by default. To configure HMA, use the steps mentioned here. Edit: Hybrid Modern Authentication (HMA) can now be configured for Hybrid deployment with multiple tenants. Today we are happy to announce an update to the Exchange Hybrid Configuration Wizard (HCW) which enables either a Full or Minimal Hybrid deployment from a single on-premises organization to more than one cloud tenant.

Update wizard exe