In addition all Exchange 2010 servers must be removed from the organisation or the ability to even configure HMA will not be available.

In order to support HMA your Exchange servers must be patched to Exchange 2013 CU19 or later/Exchange 2016 CU8 or later. Hybrid Modern Authentication (HMA) allows you to secure your on-premises Exchange and Skype for Business estate using the benefits of Modern Authentication, such as Azure AD Conditional Access and Multi-Factor Authentication (MFA). In this part I will explain how to configure Hybrid Modern Authentication with Exchange 2016. This isn’t required for Autodiscover, MAPI, Outlook Anywhere or EWS because they are supported by Hybrid Modern Authentication. In Part 1 I explained how to configure Kerberos authentication for Outlook Web App in Exchange 2016 to prepare for publishing via the Azure Application Proxy. In this series of blogs I’m going to look at the end-to-end process of taking an organisation from not publishing any Exchange on-premises services to the internet, to publishing Autodiscover, Outlook and OWA/Outlook on the Web externally, secured with Azure AD Conditional Access, Hybrid Modern Authentication and the Azure Application Proxy.

And whereas Exchange Online has previously been the first entry point for many organisations, the ever-improving security offerings within Azure AD can now offer a better initial introduction to the cloud, in some instances without the need to migrate any data at all. As Microsoft continue to develop the functionality in Office 365 and Azure AD, the cloud becomes a more and more attractive proposition for organisations that previously would not have been able to move data away from their on-premises servers.

Exchange modern authentication