Server roles in Exchange 2013/Exchange 2010 hybrid deployments

When you configure a hybrid deployment in an Exchange 2010 organization, we strongly recommend at least one Exchange 2013 server with the Client Access and Mailbox server roles. The Exchange 2013 Client Access and Mailbox servers coordinate message transport and messaging features between your existing on-premises Exchange 2010 organization and the Exchange Online organization.

We highly recommend installing more than one Exchange 2013 server in your on-premises Exchange 2010 organization to help increase reliability and availability of hybrid deployment features.

Server roles in a hybrid deployment

Here's a quick overview of the Exchange 2013 server roles in a hybrid deployment:

• Client Access server role: Provides many of the same functions as Exchange 2010 Client Access servers, with some required additions for hybrid deployments and coexistence with Exchange 2010:

  • Secure messages sent from the Exchange Online organization to the on-premises organization
  • Transport rules.
  • Journaling policies.
  • Message delivery to Mailbox servers in a hybrid deployment.

  A dedicated Receive connector is configured by default to support secure hybrid mail transport.

  All client connectivity (for example, Outlook client access, Outlook Web App, and Outlook Anywhere) goes through the Client Access server role.

  The Exchange 2013 Client Access server also handles organization relationship features between the on-premises and Exchange Online organizations (for example free/busy sharing).

  For more information, see Client Access server role in Exchange 2013.

• Mailbox server role: Handles secure mail sent from the on-premises Exchange 2010 organization to the Exchange Online organization.

  Although not typical, it can also host mailboxes and proxy communicate with the Exchange Online organization via the on-premises Client Access server.

  By default, a dedicated Send connector is configured on the Mailbox server role to support secure hybrid mail transport.

  For more information, see Mailbox server role in Exchange 2013.

Depending on the hybrid deployment configuration you want, an Exchange 2013 server requires one or both server roles:

• Single Exchange server: You need to install both the Client Access and Mailbox server roles on the single server.

• More than one Exchange server: The best practice and recommended server configuration is the Client Access and Mailbox server roles on each Exchange 2013 server. But you can also install each role individually on Exchange 2013 servers.

For more information about Exchange capacity planning, see Understanding Multiple Server Role Configurations in Capacity Planning.

Exchange server functionality in hybrid deployments

Exchange 2013 servers provide several important functions for your on-premises Exchange 2010 organization in a hybrid deployment:

• Federation: Exchange 2013 servers enable you to create a federation trust for your on-premises Exchange 2010 organization with the Microsoft Federation Gateway. The Microsoft Federation Gateway is a free, cloud-based service offered by Microsoft that acts as the trust broker between your on-premises Exchange organization and the Microsoft 365 or Office 365 organization. Federation is a requirement for creating an organization relationship between the on-premises and the Exchange Online organizations.

  For more information, see Understanding Federation.

• Organization relationships: Exchange 2013 Client Access servers enable organization relationships between the on-premises Exchange 2010 and Exchange Online organizations. Organization relationships are required for many services in a hybrid deployment. For example:

  • Calendar free/busy information sharing.
  • Message tracking.
  • Mailbox moves between the on-premises and Exchange Online organizations.

  For more information, see Sharing.

• Message transport: Exchange 2013 servers with the Client Access and Mailbox server roles are responsible for message transport in a hybrid deployment. The servers use Send and Receive connectors to:

  • Receive incoming messages from external senders on the internet.
  • Provide outbound message delivery to the internet and the Exchange Online organization.

  For more information, see Transport options in Exchange 2013/Exchange 2010 hybrid deployments.

• Message transport security: Exchange 2013 servers with the Client Access and Mailbox server roles use the Domain Security feature to secure message communication between the on-premises Exchange 2010 organization and the Exchange Online organization. You can increase security by using mutual Transport Layer Security (TLS) authentication and encryption for mail.

  For more information, see Understanding Domain Security.

• Outlook Web App: Exchange 2013 Client Access servers support a single URL endpoint for external connections to on-premises Exchange 2010 mailboxes and Exchange Online mailboxes:

  • On-premises mailboxes: Exchange 2013 Client Access servers service Outlook Web App requests.
  • Exchange Online mailboxes: Exchange 2013 Client Access servers display a link to the Outlook on the web URL in Exchange Online.

  For more information, see Outlook Web App.

Exchange server topology

As you introduce Exchange 2013 servers into an Exchange 2010 organization for hybrid deployments, the Exchange servers must meet the following requirements:

• Exchange 2010: Exchange 2010 Service Pack 3 (SP3) with Update Rollup 11 (RU11) or later.
• Exchange 2013: Exchange 2013 Cumulative Update 15 (CU15) or later to enable compatibility and full hybrid functionality with Microsoft 365.

The following table summarizes the changes in services after configuring a hybrid deployment:

Exchange server software

Exchange 2013 CU15 or later enables hybrid deployment functionality with the Hybrid Configuration wizard (HCW). You can use any Exchange 2013 CU15 or later media when installing more Exchange 2013 servers.

For information on how to download the latest version of Exchange Server, see Updates for Exchange Server.