Will the ClientAuth Certificate Change Break Your Exchange Hybrid Mail Flow?

The short answer

If your Exchange hybrid deployment uses OAuth with certificate-based authentication, yes - the removal of ClientAuth from publicly trusted certificates will break your configuration. Mail will stop flowing between your on-premises servers and Microsoft 365 until you update your certificates and authentication method. The fix is straightforward if you act before the deadline.

What is ClientAuth and why does it matter in Exchange Hybrid?

ClientAuth is a certificate extension that identifies the certificate holder as an authentication entity. In Exchange hybrid environments, it appears in the authentication certificates that hybrid servers use to prove their identity when making OAuth connections to Microsoft 365.

When you set up Exchange hybrid using modern authentication, your on-premises Exchange server presents a certificate to Microsoft 365 to establish a trusted OAuth relationship. That certificate must include the ClientAuth extension to be accepted. Microsoft is removing this extension from publicly trusted certificates because the extension has been deprecated in favor of more secure authentication methods.

The key point: if your hybrid environment uses OAuth for mail flow between on-premises and Microsoft 365, you have a certificate with ClientAuth. That certificate will stop working when Microsoft enforces the change.

Which Exchange Hybrid configurations are affected?

Not every hybrid deployment uses ClientAuth certificates. Here is how to tell if yours is affected:

Affected configurations:

Exchange 2016 or Exchange 2019 with hybrid modern authentication enabled
OAuth certificate-based authentication between on-premises and Microsoft 365
Hybrid Exchange deployments that use the Exchange Deployment Assistant or the Hybrid Configuration Wizard

Not affected:

Traditional federation-based hybrid deployments (AD FS)
Deployments that use basic authentication only
Standalone Exchange environments without Microsoft 365 integration

If you are not sure, check your hybrid configuration. The affected servers will have an OAuth certificate installed in Exchange that includes the ClientAuth extension.

What happens when ClientAuth is removed?

When Microsoft enforces the certificate change, three things happen:

Your hybrid OAuth authentication will fail. The certificate will be rejected because it includes the deprecated ClientAuth extension.
Mail flow between on-premises and Microsoft 365 will stop. Messages sent from one environment to the other will queue and eventually bounce.
Calendar free/busy sharing will break. Users will lose real-time availability information between environments.

The timeline matters. Microsoft announced this change with advance notice and a phased rollout. The exact date varies by tenant, but the enforcement is already underway. If you have not acted yet, you are already past due.

How to check if your hybrid deployment is affected

Open Exchange Management Shell on your hybrid server and run:

Get-ExchangeCertificate | Where-Object {$_.Services -like "*IIS*" -and $_.Subject -like "*yourdomain*"} | Format-List Subject, Issuer, Services, TenantId, Thumbprint

Look for the certificate that is assigned to IIS and used for hybrid OAuth. Check whether it includes the ClientAuth extension by examining the certificate properties:

$cert = Get-ExchangeCertificate -Thumbprint "YOURTHUMBPRINT" $cert | Format-List *

If the Services field shows IIS and the certificate is used for hybrid connections, it is affected.

You can also check in the Exchange Admin Center under Servers > Certificates. The hybrid OAuth certificate will be marked as active for hybrid features.

Step-by-step: preparing your hybrid environment for the certificate change

Microsoft has published guidance for this transition. The exact steps depend on your current configuration, but the general path is:

Obtain a new certificate without ClientAuth. You will need a new certificate from your CA. This can be your internal CA or a public CA, depending on your environment.
Create a new OAuth certificate in Exchange. Do not simply replace the existing certificate. Create a new one:

$cert = New-ExchangeCertificate -KeySize 2048 -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Exchange Server Authentication Certificate" -Services SMTPft 365 to establish a trusted OAuth relationship. That certificate must include the ClientAuth extension to be accepted. Microsoft is removing this extension from publicly trusted certificates because the extension has been deprecated in favor of more secure authentication methods.

Which Exchange Hybrid configurations are affected?

Not every hybrid deployment uses ClientAuth certificates. Here is how to tell if yours is affected:

Affected configurations:

Exchange 2016 or Exchange 2019 with hybrid modern authentication enabled
OAuth certificate-based authentication between on-premises and Microsoft 365
Hybrid Exchange deployments that use the Exchange Deployment Assistant or the Hybrid Configuration Wizard

Not affected:

Traditional federation-based hybrid deployments (AD FS)
Deployments that use basic authentication only
Standalone Exchange environments without Microsoft 365 integration

If you are not sure, check your hybrid configuration. The affected servers will have an OAuth certificate installed in Exchange that includes the ClientAuth extension.

What happens when ClientAuth is removed?

When Microsoft enforces the certificate change, three things happen:

Your hybrid OAuth authentication will fail. The certificate will be rejected because it includes the deprecated ClientAuth extension.
Mail flow between on-premises and Microsoft 365 will stop. Messages sent from one environment to the other will queue and eventually bounce.
Calendar free/busy sharing will break. Users will lose real-time availability information between environments.

How to check if your hybrid deployment is affected

Open Exchange Management Shell on your hybrid server and run:

Get-ExchangeCertificate | Where-Object {$_.Services -like "*IIS*" -and $_.Subject -like "*yourdomain*"} | Format-List Subject, Issuer, Services, TenantId, Thumbprint

Look for the certificate that is assigned to IIS and used for hybrid OAuth. Check whether it includes the ClientAuth extension by examining the certificate properties:

$cert = Get-ExchangeCertificate -Thumbprint "YOURTHUMBPRINT" $cert | Format-List *

If the Services field shows IIS and the certificate is used for hybrid connections, it is affected.

You can also check in the Exchange Admin Center under Servers > Certificates. The hybrid OAuth certificate will be marked as active for hybrid features.

Step-by-step: preparing your hybrid environment for the certificate change

Microsoft has published guidance for this transition. The exact steps depend on your current configuration, but the general path is:

Obtain a new certificate without ClientAuth. You will need a new certificate from your CA. This can be your internal CA or a public CA, depending on your environment.
Create a new OAuth certificate in Exchange. Do not simply replace the existing certificate. Create a new one:

$cert = New-ExchangeCertificate -KeySize 2048 -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Exchange Server Authentication Certificate" -Services SMTP

Hybrid Exchange deployments that use the Exchange Deployment Assistant or the Hybrid Configuration Wizard

If you are not sure, check your hybrid configuration. The affected servers will have an OAuth certificate installed in Exchange that includes the ClientAuth extension.

What happens when ClientAuth is removed?

When Microsoft enforces the certificate change, three things happen:

Your hybrid OAuth authentication will fail. The certificate will be rejected because it includes the deprecated ClientAuth extension.
Mail flow between on-premises and Microsoft 365 will stop. Messages sent from one environment to the other will queue and eventually bounce.
Calendar free/busy sharing will break. Users will lose real-time availability information between environments.

How to check if your hybrid deployment is affected

Open Exchange Management Shell on your hybrid server and run:

Get-ExchangeCertificate | Where-Object {$_.Services -like "*IIS*" -and $_.Subject -like "*yourdomain*"} | Format-List Subject, Issuer, Services, TenantId, Thumbprint

Look for the certificate that is assigned to IIS and used for hybrid OAuth. Check whether it includes the ClientAuth extension by examining the certificate properties:

$cert = Get-ExchangeCertificate -Thumbprint "YOURTHUMBPRINT" $cert | Format-List *

If the Services field shows IIS and the certificate is used for hybrid connections, it is affected.

You can also check in the Exchange Admin Center under Servers > Certificates. The hybrid OAuth certificate will be marked as active for hybrid features.

Step-by-step: preparing your hybrid environment for the certificate change

Microsoft has published guidance for this transition. The exact steps depend on your current configuration, but the general path is:

Obtain a new certificate without ClientAuth. You will need a new certificate from your CA. This can be your internal CA or a public CA, depending on your environment.
Create a new OAuth certificate in Exchange. Do not simply replace the existing certificate. Create a new one:

Calendar free/busy sharing will break. Users will lose real-time availability information between environments.

How to check if your hybrid deployment is affected

Open Exchange Management Shell on your hybrid server and run:

Get-ExchangeCertificate | Where-Object {$_.Services -like "*IIS*" -and $_.Subject -like "*yourdomain*"} | Format-List Subject, Issuer, Services, TenantId, Thumbprint

Look for the certificate that is assigned to IIS and used for hybrid OAuth. Check whether it includes the ClientAuth extension by examining the certificate properties:

$cert = Get-ExchangeCertificate -Thumbprint "YOURTHUMBPRINT" $cert | Format-List *

If the Services field shows IIS and the certificate is used for hybrid connections, it is affected.

You can also check in the Exchange Admin Center under Servers > Certificates. The hybrid OAuth certificate will be marked as active for hybrid features.

Step-by-step: preparing your hybrid environment for the certificate change

Microsoft has published guidance for this transition. The exact steps depend on your current configuration, but the general path is:

Obtain a new certificate without ClientAuth. You will need a new certificate from your CA. This can be your internal CA or a public CA, depending on your environment.
Create a new OAuth certificate in Exchange. Do not simply replace the existing certificate. Create a new one:

$cert = Get-ExchangeCertificate -Thumbprint "YOURTHUMBPRINT" $cert | Format-List *

If the Services field shows IIS and the certificate is used for hybrid connections, it is affected.

You can also check in the Exchange Admin Center under Servers > Certificates. The hybrid OAuth certificate will be marked as active for hybrid features.

Step-by-step: preparing your hybrid environment for the certificate change

Microsoft has published guidance for this transition. The exact steps depend on your current configuration, but the general path is:

Obtain a new certificate without ClientAuth. You will need a new certificate from your CA. This can be your internal CA or a public CA, depending on your environment.
Create a new OAuth certificate in Exchange. Do not simply replace the existing certificate. Create a new one:

$cert = New-ExchangeCertificate -KeySize 2048 -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Exchange Server Authentication Certificate" -Services SMTPDo not simply replace the existing certificate. Create a new one:$cert = New-ExchangeCertificate -KeySize 2048 -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Exchange Server Authentication Certificate" -Services SMTP

Publish the new certificate to Azure AD. Use the Azure AD Connect wizard or manually update the service principal:

Update-AzAdServicePrincipal -DisplayName "Exchange" -KeyId "YOURKEYID"

Wait for replication. Azure AD replication can take up to 24 hours.
Test OAuth connectivity:

Test-OAuthAuthentication -Service EWS -Mailbox "testuser@yourdomain.com" -Verbose

Remove the old certificate only after confirming the new one works:

Remove-ExchangeCertificate -Thumbprint "OLDTHUMBPRINT"

Verify hybrid mail flow. Send a test message from on-premises to Microsoft 365 and vice versa.

How to verify your hybrid mail flow after the change

After you have updated your certificates, verify everything is working:

Check the hybrid mail flow test in Exchange Admin Center: Mail Flow > Test Mail Flow. Use the test option to verify both directions.
Monitor the transport queues. In Exchange Management Shell:

Get-Queue | Where-Object {$_.Identity -like "*Hybrid*" -and $_.MessageCount -gt 0}

Healthy queues will be empty or near-empty.

Verify OAuth connectivity for calendar free/busy:

Test-FederationTrust -UserPrincipalName testuser@yourdomain.com

Check the Exchange health set:

Get-ServerHealth -Identity "YOURSERVER" -HealthSetName "Exchange"

If any alerts appear, resolve them before assuming the transition is complete.

Common Questions

Does this affect all Exchange hybrid deployments?

No. Only deployments that use OAuth with certificate-based authentication are affected. Traditional AD FS-based federation does not use ClientAuth certificates for this purpose.

What is the timeline for this change?

Microsoft is enforcing the change with a phased rollout that is already underway. The exact deadline depends on your tenant, but the window to act is narrowing. Microsoft has been clear that the old certificates will stop working - it is not a question of if, but when.

Can I use the same certificate after the change?

No. Certificates that include ClientAuth will be rejected. You need a new certificate without ClientAuth. Your existing certificate cannot be patched or modified to remove the extension.

Will mail stop flowing if I do nothing?

Yes. When Microsoft enforces the change, your hybrid OAuth authentication will fail and mail will stop flowing between environments. This is not a gradual degradation - it is a hard cutoff.

Does DMARC or email authentication play a role here?

Email authentication (DKIM, SPF, DMARC) operates independently of this certificate change. ClientAuth affects how your Exchange servers authenticate to Microsoft 365 for OAuth, not how your domains authenticate inbound mail.

That said, infrastructure changes are a good time to review your overall email security posture. During any major Exchange change, it makes sense to verify your authentication records are correct and monitor for issues.

DMARCFlow can help monitor your authentication posture during infrastructure changes. It aggregates and analyzes your DMARC reports to help you catch authentication issues - whether they come from certificate changes, DNS updates, or other infrastructure work.

How long does this transition take?

If you have a new certificate ready, the actual change takes under an hour. The bulk of the time is waiting for Azure AD replication. Plan for 24-48 hours total to account for replication delays and verification testing.

The action checklist is simple: get a new certificate without ClientAuth, apply it to Exchange, update Azure AD, test, and remove the old certificate. Do not wait for a reminder from Microsoft. By the time you get that email, you may already be in the middle of a mail flow outage.