The four glue systems (what hybrid actually is)
- Directory glue (prerequisite, not HCW's): Entra Connect sync — one identity, attributes flowing up. Source of authority stays on-prem for synced objects: the fact behind the whole 'must keep a management foothold' story (next concepts).
- Mail-flow glue: the connector pair + AuthAs Internal preservation (hybrid mail-flow concept) — cross-premises mail as one org.
- Trust/federation glue: the org relationship powering free/busy and calendar sharing across the seam (freebusy concept) — historically EWS-fuelled, hence the retirement shadow.
- Migration plumbing: MRS endpoints for remote mailbox moves (migration concept) — the reason many hybrids exist at all.
Classic vs modern topology: classic = your Exchange servers publish the endpoints (certs, firewall, the full estate); modern = the Hybrid Agent proxies migration/free-busy inbound through an outbound-only connection (no published Exchange, fewer certs, constraints on advanced scenarios). Modern for migration-and-coexistence simplicity; classic when centralized transport or complex routing demands the full plumbing.
The honest questions per estate
'Why are we still hybrid?' has exactly four possible answers (the glue systems) — audit which you still USE: migrations finished? plumbing idle. Free/busy to on-prem populations gone? trust glue idle. No on-prem mailboxes mailing? flow glue idle. Only the directory glue is truly sticky (until the recipient-management story — next concept — resolves it). Idle glue is attack surface plus certificate-renewal liability (two curricula of cert-day outages agree), and 'hybrid forever by inertia' is the most common Exchange architecture in the wild.
What to watch (proofs)
- Glue usage telemetry: cross-premises message volumes (trace), free/busy cross-lookups, migration batch history — each glue system's idle/active state as data, reviewed twice a year.
- The trust anchors: hybrid certificates' expiry runway (connector
- published endpoints) — the calendar entry that prevents the classic outage.
- HCW re-run hygiene: config drift between HCW-managed objects and reality (our scanned connector/org config diffs catch manual 'fixes' that the next HCW run will fight).
- Decommission readiness score: the four glues' status + the recipient-management dependency — the artifact that turns 'some day' into a project with an end date.