How to Clean Up Certificates from Office 365 Exchange Online Hybrid Application

Since Microsoft deprecated the Credential parameter in Exchange Online PowerShell versions released after June 2026, we'll use certificate-based authentication. First, connect to Exchange Online using your application certificate.

Import-Module ExchangeOnlineManagement

# Connect using certificate-based authentication
Connect-ExchangeOnline -CertificateThumbprint "YOUR_CERT_THUMBPRINT" -AppId "YOUR_APP_ID" -Organization "yourtenant.onmicrosoft.com"

Replace YOUR_CERT_THUMBPRINT with your certificate's thumbprint and YOUR_APP_ID with your registered application ID.

Before removing certificates, identify which certificates are currently registered with the Office 365 Exchange Online application. We'll examine the service principal to see all associated certificates.

# Connect to Azure AD PowerShell
Connect-AzureAD

# Find the Exchange Online service principal
$ExchangeOnlineSP = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Exchange Online'"

# List all certificates associated with the service principal
$ExchangeOnlineSP.KeyCredentials | Select-Object KeyId, Type, Usage, StartDate, EndDate | Format-Table -AutoSize

This command displays all certificates, including their KeyId (which we'll need for removal), expiration dates, and usage types.

Microsoft provides the ConfigureExchangeHybridApplication.ps1 script to manage certificates in hybrid environments. Download this script from the official Microsoft repository.

# Create a working directory
New-Item -ItemType Directory -Path "C:\ExchangeHybridScripts" -Force
Set-Location "C:\ExchangeHybridScripts"

# Download the script (replace with current Microsoft URL)
Invoke-WebRequest -Uri "https://github.com/microsoft/CSS-Exchange/raw/main/Hybrid/ConfigureExchangeHybridApplication.ps1" -OutFile "ConfigureExchangeHybridApplication.ps1"

# Verify the script downloaded successfully
Get-ChildItem -Name "ConfigureExchangeHybridApplication.ps1"

The script should be approximately 15-20KB in size. If the download fails, check your internet connection and ensure the URL is current.

Before making any changes, use the script to audit current certificate credentials in the Exchange Online application. This provides a baseline of what certificates exist.

# Set execution policy if needed
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force

# Run the script in audit mode to list current certificates
.\ConfigureExchangeHybridApplication.ps1 -ListCredentials

# Alternative: Run with specific tenant information
.\ConfigureExchangeHybridApplication.ps1 -TenantId "your-tenant-id" -ListCredentials

The script will display all certificate credentials currently associated with the Exchange Online application, including their creation dates, expiration dates, and key identifiers.

Now remove the identified outdated certificates using the script. You'll need the KeyId values from the previous step.

# Remove a specific certificate by KeyId
.\ConfigureExchangeHybridApplication.ps1 -RemoveCredential -KeyId "12345678-1234-1234-1234-123456789012"

# Remove multiple certificates (replace with actual KeyIds)
$CertsToRemove = @(
    "12345678-1234-1234-1234-123456789012",
    "87654321-4321-4321-4321-210987654321"
)

foreach ($KeyId in $CertsToRemove) {
    Write-Host "Removing certificate with KeyId: $KeyId"
    .\ConfigureExchangeHybridApplication.ps1 -RemoveCredential -KeyId $KeyId
    Start-Sleep -Seconds 2
}

The script will connect to Azure AD, locate the Exchange Online service principal, and remove the specified certificate credentials.

Remove corresponding certificates from your on-premises Exchange servers. Connect to Exchange Management Shell on your hybrid server.

# Open Exchange Management Shell and list current certificates
Get-ExchangeCertificate | Where-Object {$_.Status -eq "Valid"} | Select-Object Thumbprint, Subject, NotAfter, Services

# Remove expired certificates (replace thumbprint with actual values)
$ExpiredCerts = Get-ExchangeCertificate | Where-Object {$_.NotAfter -lt (Get-Date)}

foreach ($Cert in $ExpiredCerts) {
    Write-Host "Removing expired certificate: $($Cert.Subject)"
    Remove-ExchangeCertificate -Thumbprint $Cert.Thumbprint -Confirm:$false
}

# Remove specific certificate by thumbprint
Remove-ExchangeCertificate -Thumbprint "A1B2C3D4E5F6789012345678901234567890ABCD" -Confirm:$false

This removes certificates from the local certificate store on your Exchange server.

After removing certificates, test your hybrid configuration to ensure mail flow and other hybrid features still work correctly.

# Test hybrid connectivity from Exchange Online
Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer "your-hybrid-server.domain.com" -Credentials (Get-Credential)

# Test mail flow from on-premises
Test-MailFlow -TargetEmailAddress "testuser@yourdomain.com" -TargetDatabase "Mailbox Database 01"

# Check hybrid configuration status
Get-HybridConfiguration | Select-Object *Domain*, *Certificate*

# Verify OAuth authentication is working
Test-OAuthConnectivity -Service EWS -TargetUri "https://outlook.office365.com/ews/exchange.asmx" -Mailbox "testuser@yourdomain.com"

These tests verify that certificate removal hasn't broken your hybrid deployment.

Document the certificate cleanup and establish monitoring to prevent future certificate accumulation issues.

# Create a certificate monitoring script
$MonitoringScript = @'
# Certificate monitoring script - save as Monitor-HybridCertificates.ps1
Connect-ExchangeOnline -CertificateThumbprint "YOUR_CERT_THUMBPRINT" -AppId "YOUR_APP_ID" -Organization "yourtenant.onmicrosoft.com"
Connect-AzureAD

$ExchangeOnlineSP = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Exchange Online'"
$ExpiringCerts = $ExchangeOnlineSP.KeyCredentials | Where-Object {$_.EndDate -lt (Get-Date).AddDays(30)}

if ($ExpiringCerts) {
    Write-Warning "Found $($ExpiringCerts.Count) certificates expiring within 30 days"
    $ExpiringCerts | Select-Object KeyId, EndDate | Format-Table
}
'@

$MonitoringScript | Out-File "Monitor-HybridCertificates.ps1"

# Create documentation of current state
$Documentation = @"
Certificate Cleanup Completed: $(Get-Date)
Certificates Removed: $($CertsToRemove.Count)
Next Review Date: $((Get-Date).AddMonths(3).ToString('yyyy-MM-dd'))
"@

$Documentation | Out-File "Certificate-Cleanup-Log.txt" -Append

This creates a monitoring script you can run monthly to check for expiring certificates.