SharePoint Server · Hybrid architecture

Hybrid Architecture Advisor

Describe the farm, its identities, its network and the hybrid features you want. The advisor says, for each feature, whether Microsoft's documentation supports it on that farm, what is missing, and what is not established, and generates the working documents.

Every rule cites Microsoft's documentation, read on 13 November 2026. A feature is never reported as ready: the furthest a row goes is that no blocker was declared and it must be validated. What you do not answer stays unknown in every file.

Organisation and project

Optional. These four values appear on the cover of each document and nowhere else.

The farm
Which SharePoint Server version does the farm run?

Central Administration shows the farm's build under Upgrade and Migration, Check product and patch installation status.

Which public update is the farm on?

Microsoft supports each Subscription Edition public update for one year from its release, and cloud hybrid search needs the July 2025 public update or later.

Is the farm highly available?

It decides whether an update can be installed without downtime, and whether search can lose a server.

Which service applications run on the farm?

Select all that run. Microsoft's hybrid pages name these as the services hybrid features rely on.

How do users sign in to the web applications that hybrid features will be used from?

Select all that apply. Microsoft documents the farm's hybrid calls from web applications that use Integrated Windows authentication.

Does the farm run SharePoint add-ins that authenticate today?

Configuring the server-to-server trust changes the farm's authentication realm, and Microsoft's page says existing add-ins then fail to authenticate until they are fixed.

Microsoft 365 and identity
Does the organisation have a Microsoft 365 tenant with SharePoint in Microsoft 365?
Is the organisation's public domain verified in the tenant, with users' UPN suffix matching it?

Microsoft's hybrid configuration starts by registering the domain and assigning a matching UPN suffix to the accounts.

How are on-premises accounts synchronised to Microsoft Entra ID?

Synchronising accounts is not single sign-on: it puts the same people in both directories. Microsoft's hybrid pages do not require single sign-on.

Do the people who will use hybrid features hold a Microsoft 365 licence that includes SharePoint in Microsoft 365?

Microsoft's pages ask for a licensed user and do not agree with each other on the plans; check your own agreement. This advisor states no licensing rule.

In the User Profile service application, is User Principal Name mapped to userPrincipalName and Work email to mail?

Microsoft documents these two mappings as what lets the farm and Microsoft 365 recognise the same person.

Can a Global Administrator of the tenant take part in the configuration?

The Hybrid Configuration Wizard and the cloud hybrid search onboarding script both ask for one. Microsoft documents no lesser role.

Has Microsoft Support added the tenant to the Hybrid Allow List?

Microsoft's wizard page says hybrid features are enabled only for tenants on that list, and that Support adds a tenant on request.

Network and certificates
Can the farm's servers reach Microsoft 365 over HTTPS?
Which certificate does the farm's security token service sign with?

Microsoft recommends the default certificate for hybrid and says it does not need to be renewed; a replacement expires.

Is that certificate's expiry date recorded, with a named owner for its renewal?
Is the farm already published to the internet through a reverse proxy with a certificate from a public authority?

Only inbound scenarios need it. With cloud hybrid search it is one of the two ways people open an on-premises result from outside the network.

Which Windows Server version do the farm's servers run?

Microsoft's page says Subscription Edition supports TLS 1.3 when deployed with Windows Server 2022, and not on earlier versions.

The hybrid features wanted
Which hybrid features does the organisation want?

Select every feature under consideration. Each is configured on its own and none of them moves a document.

Was a cloud Search service application onboarded to cloud hybrid search before July 2025?

The service behind it retired on 30 June 2025; Microsoft's page says the onboarding must be run again.

Is there a server for the cloud Search service application with at least 100 GB of storage, 16 GB of memory and four 1.8 GHz processors?
Is access to the content to be crawled granted through default Active Directory groups such as Domain Users?

Those groups are not synchronised, so people who hold access only through them get no on-premises results.

Must people open on-premises search results from outside the corporate network?
After hybrid taxonomy is configured, where will term sets be edited?

Replication runs one way, from Microsoft 365 to the farm.

Do people have files in their on-premises OneDrive (My Site) that they still need?

Redirection changes where the OneDrive link goes. It moves no file.

Operations, security and direction
Does a named person or team own the farm's monthly public updates?
Is anybody watching certificate expiry, crawl health and directory synchronisation today?
Does a policy or contract forbid placing metadata or content from the farm in Microsoft 365?

Cloud hybrid search adds what it crawls to the search index in Microsoft 365.

Is hybrid meant to stay, or to end?
What is planned for the farm itself?
The package
Which package?

The advisor above assesses a farm from your answers. This reference sets out what it decides, how, and what it does not do. The chapters behind it are in the Hybrid Architecture Field Guide.

What it assesses

It asks aboutBecause
The SharePoint Server version and public updateCloud hybrid search continues only on Subscription Edition from the July 2025 public update, and Microsoft supports each public update for one year
The farm's topology and service applicationsEach hybrid feature relies on named services, and an update without downtime needs a highly available farm
How users sign in, and whether add-ins authenticate todayMicrosoft documents hybrid calls from web applications that use Integrated Windows authentication, and creating the trust changes the farm's authentication realm
The tenant, the domain, synchronisation, licences and profile mappingsHybrid recognises a person only if both sides hold the same identity
A Global Administrator and the Hybrid Allow ListThe Hybrid Configuration Wizard, which enables every feature including hybrid OneDrive, and the search onboarding need the first; Microsoft's wizard page requires the second
Outbound access, the signing certificate, a reverse proxy, the operating systemThe trust, its expiry, and how an on-premises result opens from outside
The hybrid features wanted, and the facts each depends onEach feature is assessed on its own
Operations, the data rule, and whether hybrid stays or endsA hybrid farm stays a farm, and an index in Microsoft 365 is a decision somebody owns

It asks for no tenant name, host name, address, account or credential.

How readiness is decided

Each capability gets one state, decided in a fixed order that no answer can change:

  1. Not requested: you did not ask for it.
  2. Unsupported as declared: Microsoft's documentation retires it, or does not support it on that version or update.
  3. Blocked: a prerequisite was declared missing.
  4. Not established: an answer the row needs is missing, or Microsoft's documentation does not settle the configuration.
  5. No blocker declared: validate on the farm.

There is no state that says ready, supported or compliant. An unanswered question keeps a row at not established, and a partly completed assessment reads as partly unknown, in the result and in every file. No score, percentage or grade is produced.

What it generates

DocumentFormatQuick assessmentEngineering assessment
Hybrid Readiness AssessmentWordYesYes
Hybrid Architecture Decision RecordWordYesYes
Hybrid Prerequisites Matrix, owner of CMP-ExcelYesYes
Hybrid Risk Register, owner of RSK-, with the Governance Control MatrixExcelYesYes
Identity and Trust Matrix, with the Certificate RegisterExcelNoYes
Search Architecture Decision MatrixExcelNoWhen a search feature is wanted
Taxonomy Mapping Workbook, with content types and governanceExcelNoWhen hybrid taxonomy is wanted
Hybrid Validation Checklist, owner of TST-ExcelNoYes
Hybrid Transition Plan, owner of TSK-, with the Migration Decision Matrix and the Go or No-Go checklistExcelNoYes
Hybrid Monitoring ChecklistExcelNoYes
Hybrid Configuration and Validation RunbookWordNoYes
Hybrid Security AssessmentWordNoYes
Hybrid Operations RunbookWordNoYes

Every package also carries 00 Assessment Model.json: the answers and the model every file was generated from, with the version of the rules. Load it back to change an answer and assess again.

Each row, finding, task and test has one identifier, the same in every file, and each identifier is owned by one workbook. Registers that describe your environment (the certificate register, the term group mapping, the content sources) start empty, with their columns and validations: the advisor reads nothing, so it lists nothing as found.

What it rests on

Every rule cites the page of Microsoft's documentation it comes from, read on 13 November 2026, and each document lists the pages it relies on. Where Microsoft's pages disagree with each other, or say nothing, the advisor says not established and names the test that would settle it on your farm. The reasoning, with the quotations, is in the guide: readiness, identity and trust and search.

What it does not do

  • It does not read, scan or connect to a farm or a tenant. What the documents say about either is what was declared.
  • It does not say a configuration works. The furthest it goes is that nothing declared blocks it, and that it must be validated.
  • It states no licensing rule. Microsoft's pages do not agree on the plans; check your own agreement.
  • It does not make SharePoint Server anything other than an on-premises product, and assumes no Microsoft 365 capability reaches the farm unless Microsoft's documentation says so.
  • It does not store or send anything. The files are built in your browser, and closing the page leaves only what you downloaded.

Where this fits

This tool is free, and it stays free. If it saved you time, you can support its maintenance.

Buy me a coffee (opens in a new tab)João Lívio's page on buymeacoffee.com