Why Your Exchange Hybrid Environment Generates Thousands of HIERARCHY_SYNC_NOTIFICATIONS

Your Exchange Hybrid environment is generating thousands of HIERARCHY_SYNC_NOTIFICATIONS notifications. You are not sure whether to panic. Short answer: probably not a security incident. The flood still needs attention, but it is almost certainly caused by something inside Exchange, not an attacker.

What Is HIERARCHY_SYNC_NOTIFICATIONS?

HIERARCHY_SYNC_NOTIFICATIONS is an internal Exchange mechanism, not an external threat. When Exchange needs to synchronize public folder hierarchy information between your on-premises environment and Exchange Online, it generates these notifications as part of the replication process. Each notification tells the target public folder mailbox to pull the latest hierarchy state from the other side of the hybrid connection.

In a normally functioning hybrid environment, a small number of these notifications appear during routine sync operations. Hundreds or thousands suggest something triggered a replication storm - a change that Exchange interpreted as a hierarchy update requiring propagation across every public folder mailbox in the organization.

What Causes the Flood?

The most common trigger is a permission change on a public folder mailbox - either in Exchange Online or on-premises. When you modify public folder mailbox permissions, Exchange treats it as a hierarchy change and propagates the update to every other public folder mailbox. If you have many public folder mailboxes and the change affects the top of the hierarchy, a single permission update can generate thousands of notifications in a cascade.

Common triggers in practice:

• Bulk permission changes - adding or removing many users from public folder access at once, especially via script
• Automation scripts that run on a schedule and repeatedly modify public folder permissions
• Migration batches that touch public folder mailbox settings during a staged cutover to Exchange Online
• Public folder moves between mailboxes, which invalidate the existing hierarchy state and force a full re-sync
• On-premises Exchange updates or patches that invalidate cached hierarchy state, causing a full refresh on the next sync cycle

If you recently ran a script that modified public folder permissions for a large group of users, that is almost certainly the source of the flood.

How to Diagnose It

First confirm these notifications are coming from your own Exchange servers and not from an external sender spoofing your internal domain.

Run this in Exchange Management Shell on-premises:

Get-Message -RecipientKeywords "HIERARCHY_SYNC" -EventType Receive |
    Select-Object Subject, From, ReceivedConnector, Timestamp |
    Sort-Object Timestamp -Descending |
    Select-Object -First 20

If the From address shows your own Exchange servers, these are internal replication notifications. If they show an external domain, that is a different problem.

To check the health of public folder hierarchy sync itself:

Get-PublicFolderMailboxDiagnostics -Identity  -Detailed

Look for DumpsterInfo entries showing repeated hierarchy state uploads or downloads.

To identify which public folder mailboxes are carrying the most hierarchy items:

Get-MailboxFolderStatistics -PublicFolder |
    Where-Object {$_.FolderType -eq "PublicFolderHierarchy"} |
    Select-Object Identity, ItemsInFolder, TotalItems

One mailbox with a disproportionately high item count is usually the origin of the storm.

To audit recent permission changes on public folder mailboxes:

Get-MailboxPermission -Identity  |
    Where-Object {$_.AccessRights -contains "FolderOwner" -or $_.AccessRights -contains "Editor"}

Check these results against any scripts or scheduled tasks that ran recently.

When to Act

Not every HIERARCHY_SYNC_NOTIFICATIONS notification is a problem. Act when:

• Your public folder mailbox is receiving more than 500 notifications per day
• Users report mailbox slowdowns or quota warnings from notification volume
• The flood coincides with a recent permission change, migration batch, or on-premises update
• A specific public folder mailbox shows elevated hierarchy item counts after the flood subsides

A small, one-time burst of notifications during or after a scheduled maintenance window can usually be ignored.

How to Stop or Reduce the Notifications

1. Find and fix the trigger.

Audit your scheduled tasks and scripts for anything touching these cmdlets:

• Add-PublicFolderMailboxPermission
• Remove-PublicFolderMailboxPermission
• Set-MailboxFolderPermission
• Update-PublicFolderMailbox

Reduce the frequency of bulk permission operations. If a script runs daily and generates a notification flood each time, consider running it weekly instead or batching changes into fewer, larger operations - fewer operations means fewer sync events.

2. Check for duplicate permission entries.

A public folder mailbox that has both an explicit and an inherited permission entry for the same user will trigger a sync every time either entry is modified. Run this to find duplicates:

Get-PublicFolderMailboxPermission -Identity  |
    Group-Object User |
    Where-Object {$_.Count -gt 1}

Remove the duplicate entries and observe whether the flood subsides over the next sync cycle.

3. Use MRS throttling for migration batches.

If you are mid-migration and the flood coincides with migration batches, the Mailbox Replication Service can be throttled to reduce how aggressively hierarchy changes propagate during active migrations. Contact Microsoft Support to configure MRS throttling policies for public folder hierarchy sync.

4. Disable hierarchy sync for specific mailboxes (last resort).

Microsoft supports disabling hierarchy sync for specific public folder mailboxes that do not require cross-tenant synchronization. This is a last-resort option and only applies to mailboxes that are entirely local and should never sync with Exchange Online. Do not disable sync for mailboxes that are part of your hybrid topology.

FAQ

Q: Are these notifications a phishing attempt? No. HIERARCHY_SYNC_NOTIFICATIONS are generated by your own Exchange servers. If the From address shows your own domain and your own servers, they are internal replication traffic. If you see these from an external sender address, that is a different issue worth investigating.

Q: Will these notifications cause my emails to fail? No. The notifications are internal replication messages and do not affect mail transport or delivery. They consume mailbox quota and can slow down OWA or Outlook access if the volume is extreme.

Q: Can I just delete these notifications? You can, but the underlying cause will keep generating them. Fix the trigger instead.

Q: My flood started right after enabling hybrid. Is this normal? Some increase in HIERARCHY_SYNC_NOTIFICATIONS is normal when you first enable hybrid and during initial synchronization. If the flood is sustained and large, something beyond the initial sync is triggering it - usually permission operations or an active migration batch.

The Short Version

Thousands of HIERARCHY_SYNC_NOTIFICATIONS in Exchange Hybrid are almost always caused by permission changes on public folder mailboxes triggering a hierarchy re-sync cascade. They are not a security incident. Find the script, bulk permission operation, or migration batch that is generating the changes and reduce how often it runs. If the flood persists after the trigger is addressed, check for duplicate permission entries or apply MRS throttling.

This issue lives entirely within Exchange's internal replication layer and does not appear in DMARC reports - your external email authentication data will not show this problem. If you want broader monitoring of hybrid mail flow reliability, that is a separate problem from DMARC monitoring.