Hybrid moves fail since Oct 2026: MRSProxy 401, Event 4625 shows "Administrator" with empty domain (endpoint credentials ignored)

Dario Steck (dplan AG) 0 Reputation points
2026-10-16T17:36:55.3633333+00:00

Since ~12 Oct 2026 23:53 UTC, all onboarding moves (Exchange 2019 CU15 -> Exchange Online, Modern Hybrid / Hybrid Agent) fail with TooManyTransientFailureRetriesPermanentException / CommunicationErrorTransientException right after "Connected to target mailbox". Test-MigrationServerAvailability still succeeds.

  • The start time matches the EXO MRS servers moving from build 15.21.496.x to 15.21.522.x.
  • IIS: POST /EWS/mrsproxy.svc -> 401 1 2148074252.
  • Event 4625 on the Exchange server: Account Name "Administrator", Account Domain empty, Sub Status 0xC000006A, NTLM, Workstation = EXO server.
  • The configured endpoint account (dedicated service account, also tried UPN format) is ignored, even though RemoteCredentialUsername on the move requests shows it.

Workaround that made us succeed with the migration at the end: renaming the local Administrator account on the Exchange server makes the moves work again.

Is anyone else seeing this? Is there a known issue or incident ID from Microsoft?

1_event4625_empty_domain.png 2_remotecred_vs_4625.png5_local_admin_renamed_moves_working.png4_status_all_three_users.png

Exchange | Hybrid management
Exchange | Hybrid management

The administration of a hybrid deployment that connects on-premises Exchange Server with Exchange Online, enabling seamless integration and centralized control.

0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Hani-Ng 2,490 Reputation points Independent Advisor
    2026-10-16T18:36:55.2066667+00:00

    Hi Dario Steck (dplan AG)

    Based on the information provided, I am not aware of any publicly documented Microsoft incident or service health advisory at this time that describes Exchange Online MRS suddenly authenticating as the local Administrator account instead of the credentials configured on the migration endpoint. I was also unable to find an official incident ID associated with this behavior.

    The symptoms you described are certainly unusual:

    • Test-MigrationServerAvailability succeeds, but the actual mailbox move fails after connecting to the target mailbox.
    • IIS logs show POST /EWS/mrsproxy.svc returning 401 Unauthorized.
    • Security Event 4625 records logon attempts using Administrator with an empty domain and NTLM authentication, while the migration endpoint is configured with a different service account.
    • Renaming the local Administrator account appears to eliminate the failed logons and allows mailbox moves to proceed.

    Given that the behavior started around the time the Exchange Online MRS servers changed builds, and considering that the configured migration credentials continue to appear correctly in the move request properties, the evidence suggests a potential service-side regression or authentication handling issue rather than a typical MRSProxy configuration problem. However, only Microsoft engineering would be able to confirm whether this is an emerging issue or an unintended change in Exchange Online.

    If you have not already done so, I would recommend opening a support case with Microsoft and providing:

    • Correlation timestamps
    • MRSProxy IIS logs showing the 401 responses
    • Event 4625 entries showing Administrator with a blank domain
    • Exchange build information
    • The observation that renaming the local Administrator account consistently restores migration functionality

    That workaround is particularly valuable because it provides a reproducible scenario that Microsoft can investigate further.

    If Microsoft confirms this as a product issue, please consider posting an update here, as it may help other administrators experiencing similar hybrid migration failures.

    This keeps the response neutral, avoids claiming a issue that Microsoft has not yet confirmed, and acknowledges the customer's findings.

    I hope this information helps.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.