Keep hybrid only for named features, each with an owner and an exit date

Hybrid is often named as a third destination. Microsoft documents something narrower: features that connect a SharePoint Server farm to SharePoint in Microsoft 365, each configured on its own, none of which moves a document, for use "during a migration from on-premises to the cloud" or "in the long term if you plan to continue using SharePoint Server" (hybrid OneDrive and SharePoint, checked on 7 November 2026).

Is hybrid an end state, or a transition with an end date, and which hybrid features does this estate actually need?

The decision this chapter leads to is the list of hybrid features the estate keeps, each with the need it serves, its owner and its exit date, or a recorded decision to run no hybrid at all.

Which estates this chapter is for

A farm and a Microsoft 365 tenant running side by side: a farm emptied into SharePoint Online in waves (Chapters 8 and 9), one kept on Subscription Edition for the sites Chapter 24 leaves on premises, or both. SharePoint Server 2016 and 2019 left support on 14 July 2026 (ending support in 2026, checked on 7 November 2026), so hybrid that lasts means Subscription Edition, attached as Chapter 23 describes and kept current as Chapter 42 does. An attach brings content, not configuration such as the trust below, so we would plan to configure hybrid again on the new farm.

What Microsoft documents, and what still runs

Most of Microsoft's hybrid pages mark themselves as applying to Subscription Edition, but its table of minimum updates per feature has no section for it.

Sources for the table: update levels, hybrid sites and search, app launcher, self-service site creation, hybrid taxonomy, hybrid search, hybrid requirements, BCS retirement, removed from 2016, hybrid auditing and new in Subscription Edition, all checked on 7 November 2026.

Inbound hybrid, where Microsoft 365 reaches into the farm, is retired for search and BCS, and Duet Enterprise is tied to 2013; what remains runs outbound. We would retire a reverse proxy and public certificate kept only for it, unless cloud hybrid search uses the proxy to open on-premises results from outside the network (cloud hybrid search, checked on 7 November 2026).

The remaining pages lag: those on profiles, site following, taxonomy and self-service site creation describe 2013 and 2016. Apart from the old cloud hybrid search, we found no notice retiring an outbound feature, and we do not know how far each was tested on Subscription Edition, so we would prove each one on the farm's current public update before relying on it.

Cloud hybrid search, in brief

As Chapter 11 details, the service behind cloud hybrid search retired on 30 June 2025; the feature continues on Subscription Edition, onboarded again, from the July 2025 public update by one page (configure cloud hybrid search, checked on 7 November 2026) and from Version 25H1 by another (cloud hybrid search, above). The roadmap says to allow the endpoints "marked for use with Hybrid Search"; Microsoft's IP address and URL web service, read anonymously on 6 November 2026, records endpoint set 33, "SharePoint Hybrid Search - Endpoint to SearchContentService where the hybrid crawler feeds documents", as removed in version 2026043000 (30 April 2026). That is a live observation, not documentation, and the two disagree. No Microsoft page we read retires the new cloud hybrid search, and we do not know which endpoints its crawler uses: we would not plan on it until a rehearsal shows on-premises results in the tenant.

What the farm owns while hybrid lasts

These stay the farm's work while any hybrid feature runs.

• The trust. For all options, the Hybrid Configuration Wizard, still the hybrid picker in SharePoint's administration pages (self-service site creation), "configures a server-to-server trust" (Hybrid Configuration Wizard, checked on 7 November 2026). Microsoft Entra ID becomes a trusted token issuer, the farm's signing certificate goes to SharePoint's principal in the tenant, and the farm's authentication realm becomes the tenant's ID: change it and "the farm will no longer participate in hybrid functionality" (configure server-to-server authentication, checked on 7 November 2026). Existing add-ins can stop authenticating when the realm changes (Hybrid Configuration Wizard): retest any that Chapter 18 keeps. The retirement of Azure ACS in SharePoint Online "is not impacting any of the SharePoint on-premises use cases", hybrid included (ACS retirement, checked on 7 November 2026).
• The certificate. The wizard uses the farm's built-in STS certificate, as Microsoft recommends (hybrid requirements), and that one "does not need to be renewed". A replacement expires, in one to three years by Microsoft's estimate, and is then replaced on every server and uploaded to the tenant again (replace the STS certificate, checked on 7 November 2026); SharePoint's service principal in the tenant keeps each upload with its end date (configure server-to-server authentication).
• Windows sign-in. Microsoft documents the farm's outbound calls only from web applications using Integrated Windows authentication, NTLM on one page (plan server-to-server authentication, checked on 7 November 2026) and NTLM or Kerberos on another. For people who sign in through a trusted provider (Chapter 21), we do not know which features work until a rehearsal shows it.
• Directory synchronisation. Hybrid needs accounts synchronised to Microsoft 365, a public domain registered in the tenant with matching UPN suffixes, and licensed users (configure Microsoft 365 for hybrid, checked on 7 November 2026). On Microsoft Entra Connect Sync, 2.x versions "retire 12 months from the date that a newer version is released", and Microsoft requires 2.6.84.0 or later with application-based authentication by 7 April 2027, after which synchronisation stops (Entra Connect versions, checked on 7 November 2026).
• The wizard. It runs on a farm server with .NET Framework 4.6.2, under an account that is farm administrator, User Profile service application administrator and Global Administrator; it checks that App Management and the User Profile proxy are online, and works only for tenants that Microsoft Support has added to the "Hybrid Allow List" (Hybrid Configuration Wizard). Taxonomy also needs Managed Metadata, and cloud hybrid search its own Search service application: on a new farm, Chapter 10's decisions.

Read the farm side before deciding anything:

# Farm server, SharePoint Management Shell. Reads hybrid configuration; changes nothing.
Write-Host "Writing hybrid settings, the realm and trusted token issuers to hybrid.txt"
Get-SPO365LinkSettings | Format-List * | Out-File .\hybrid.txt
Get-SPAuthenticationRealm | Out-File .\hybrid.txt -Append
Get-SPTrustedSecurityTokenIssuer | Format-List * | Out-File .\hybrid.txt -Append

Parsed, not yet run: try it on a test farm first.

End state or transition

Hybrid OneDrive and sites features, self-service site creation and taxonomy ease a move: they send people and new sites to Microsoft 365 while the farm is in use, limited if needed to a hybrid audience that grows with the waves (self-service site creation). Taxonomy mastered online lets both sides share term sets after the one-time copy Chapter 12 describes. Each one's exit is the wave that empties the farm of what it serves.

A redirect moves people, not content. "When redirection is used, existing data in SharePoint Server is not automatically migrated": OneDrive files and profiles move user by user, and followed sites are followed again (hybrid sites and search). Each redirect's content is copied as Chapters 8 and 9 describe, or given a disposition in Chapter 26.

The rest, outbound federated search, cloud hybrid search and the Power Apps and Power Automate commands, serve content and people that stay on the farm: they are the end-state features.

We recommend deciding hybrid feature by feature, never as an architecture, recording for each the need it serves, its owner, the trust's owner and its exit date. Where hybrid is the end state, the exit date is the day its owner confirms the need again, in our view no more than a year ahead, because Microsoft removed parts of hybrid in 2019, 2024 and 2025. If no feature earns a row, the decision is no hybrid.

Leaving hybrid

Microsoft documents the way out (removing hybrid, checked on 7 November 2026): delete the cloud hybrid search content sources, then its Search service application, asking Microsoft Support if every on-premises document must leave the tenant's results; set hybrid OneDrive and sites features to None in Central Administration, which also removes the app launcher; stop taxonomy replication; clear self-service site creation per web application; last, delete the ACS and SharePoint App Management proxies and reset IIS on every server. The page does not mention the certificate and service principal name left in the tenant; we would agree their removal with the tenant's owner. The wizard "doesn't uninstall features" (Hybrid Configuration Wizard), so this sequence is the exit: rehearse it on a test farm and keep each step's evidence.

Out of scope

Configuration steps, in Microsoft's roadmaps; search, Chapter 11; the term store copy, Chapter 12; sign-in, Chapter 21; the attach, Chapter 23; which sites go online, Chapter 24. Exchange and Teams hybrid, directory synchronisation design, plans and licensing, and B2B extranet sites, which "have no on-premises components" (update levels), are not covered.

Before you continue

• Every hybrid feature on the farm and in the tenant is listed, including any nobody remembers enabling
• Each feature kept has its need, its owner and its exit date, or the estate records that it runs no hybrid
• No plan relies on inbound search, hybrid BCS, Duet Enterprise, hybrid auditing, or cloud hybrid search on 2016 or 2019
• The trust has a named owner who knows the realm, the certificate's end date and the synchronisation deadline
• Every redirect has a plan for the content behind it: OneDrive files, profiles and followed sites
• Each feature kept on Subscription Edition was proved on the farm's current public update first
• The removal sequence is rehearsed, ending with the ACS and App Management proxies deleted

Download chapter 25 (PDF)Same text, same tables, same sources as this page.