Exchange auth certificate renewal now has a second step

The Exchange Server auth certificate has quietly changed category. It used to be a self-signed certificate that lived on your Exchange servers, expired every few years, and broke Outlook on the web when nobody noticed. It is still all of those things. It is now also a credential in your Entra tenant, and the renewal procedure most teams have written down covers only half of it.

Why there is a second place now

Exchange hybrid used to authenticate to Exchange Online through a shared first-party service principal, and the Hybrid Configuration Wizard uploaded your auth certificate to it. That design is gone. Microsoft's current guidance is unambiguous about the state of the old path:

“As of October 31, 2025, EWS access through the shared service principal is permanently blocked. Rich coexistence hybrid features (Free/Busy, MailTips, and profile picture sharing) no longer work through the legacy shared service principal workflow.”

The replacement is a dedicated application in Entra ID, one per tenant, created by Microsoft's ConfigureExchangeHybridApplication.ps1 script or by a recent HCW. Your auth certificate is uploaded to that. The security driver was CVE-2025-53786, and part of the remediation is purging the certificates previously uploaded to the shared service principal — Microsoft's words: “This practice is no longer recommended and shouldn't be performed.”

The renewal step people miss

Microsoft's dedicated-app documentation has a section headed Update the Auth Certificate. It opens:

“Use the following steps when the Auth Certificate expires or is replaced. These steps aren't required during initial configuration.”

That sentence is the whole post. The step is small — rerun the script with -UpdateCertificate, or export the new certificate and run it from a machine with outbound connectivity if your mailbox server has none. But it is a separate action, in a separate place, performed by someone who may not have been involved in the on-premises renewal, and nothing in the on-premises rotation prompts for it.

The failure it produces is the quiet kind. On-premises Exchange is fine. OWA works. Then Free/Busy lookups against Exchange Online stop returning, MailTips go missing, and profile pictures fail — and the team is looking at the on-premises certificate they just successfully renewed.

Two Microsoft pages, one collision

This is the part worth reading carefully, because following one page's advice can undo the other's security remediation.

The auth certificate article answers the obvious question directly:

Question: Is it required to rerun the Hybrid Configuration Wizard (HCW) after the Auth Certificate is replaced?
Answer: “Yes, we strongly recommend running the Hybrid Configuration Wizard (HCW) after the active Auth Certificate is replaced.”

The dedicated hybrid app article carries this warning:

“If you run the HCW after configuring the dedicated Exchange hybrid application feature and select the Oauth, Intra Organization Connector and Organization Relationship configuration option, the Auth Certificate is uploaded to the first-party Service Principal again. It's strongly recommended to repeat the steps to purge the Auth Certificate from the first-party Service Principal in this case.”

Both statements are true, and they are not a contradiction so much as a seam. The auth certificate page carries an ms.date of January 2023; the dedicated hybrid app page is dated April 2026. The older advice is correct in isolation and incomplete in the current design.

The practical consequence: run HCW after a certificate renewal, pick the obvious-looking OAuth option, and you have re-uploaded the certificate to the shared service principal that CVE-2025-53786 remediation told you to clear. Nothing errors. You will not be told. If you run HCW, purge afterwards — Microsoft supplies the command, and running it when it was not needed costs nothing.

Rotation is a two-day job, by design

The on-premises rotation itself is deliberately slow, and knowing that stops it being started in a panic. Microsoft's procedure stages the new certificate to become active “in 49 hours at the earliest” and adds:

“Our recommendation is to plan for at least 48 hours before the newly generated Auth Certificate becomes active. In large Exchange environment it can take even longer.”

⚠️ And there is a trap in the procedure worth flagging on its own. Generating the new certificate prompts: “Overwrite the existing default SMTP certificate?” with options [Y] Yes [A] Yes to All [N] No [L] No to All — and the default is Y. Microsoft's instruction is to type N. Pressing Enter, which is what a tired administrator does at the end of a command, replaces your default SMTP certificate.

Microsoft also publishes a MonitorExchangeAuthCertificate script that performs the rotation automatically and can repair an already-expired certificate. If this is not a thing your team does often — and it should not be — that is the safer route than a hand-typed procedure.

Two more things worth knowing before you touch it

• GCC High and DoD cannot use the Graph API hybrid flow yet. Microsoft's availability table marks it supported only in Microsoft 365 Global, with 21Vianet, US Government L4 (GCC High), US Government L5 (DOD), Bleu and Delos Cloud all listed as not supported. And the warning is sharp: enabling it where it is unsupported “causes hybrid features such as Free/Busy, MailTips, and profile picture sharing to stop working.” For a defense or government-adjacent tenant, EWS permissions stay.
• Graph does not yet cover everything EWS did. Microsoft's feature table lists MailTips as Partial (Automatic Replies only) under Graph, and Move to Archive as not supported at all. Microsoft's own guidance is not to remove the EWS permission if you rely on those.

One more scheduling note, because it changes when you can safely do this. Microsoft warns that after the dedicated application is configured, “it might take up to 60 minutes for the dedicated Exchange hybrid application configuration to be recognized by the responsible Exchange Server processes. During this time, features such as Free/Busy, MailTips, and Photos might be temporarily unavailable.” That is a user-visible hour, so it belongs in a change window rather than in a spare afternoon.

What we would do this week

• Find the expiry date. One command in the Exchange Management Shell returns it: (Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate, formatted to show NotAfter. If that is inside twelve months, this is a scheduled job rather than an incident waiting.
• Add the Entra step to the runbook now, not at renewal time. One line: after renewing on-premises, run ConfigureExchangeHybridApplication.ps1 -UpdateCertificate.
• Write "if HCW was run, purge the shared service principal" underneath it. That is the sentence that keeps a certificate renewal from silently reversing a CVE remediation.
• Verify with Test-OAuthConnectivity and confirm the appId in the result matches your dedicated application, rather than assuming success means the right identity was used.

Sources

Both Microsoft Learn pages were read in full on September 5, 2026: Maintain the Exchange server OAuth certificate (ms.date 2023-01-02, last updated 2025-08-05) and Deploy dedicated Exchange hybrid app (ms.date 2026-04-17). The date gap between them is the reason the HCW guidance reads differently on each, and we have quoted both rather than picking one.

If you would rather have the certificate expiry audit, the runbook update and the shared service principal clean-up handled as a bounded piece of work, scope it with us.