The mailbox is in the cloud. Now Outlook on every desk has to find it. In a hybrid migration this mostly happens on its own. In a cutover or IMAP migration every profile has to be rebuilt, and doing that by hand on two hundred machines is how a migration weekend becomes a migration month.
This post explains how Outlook locates a mailbox today, which registry settings let you script new profiles, and the settings that stop Autodiscover from working after the move.
How Outlook finds the mailbox now
Since Outlook 2016, there is no manual Exchange account setup. Outlook takes the email address, runs Autodiscover, and builds the profile from what comes back. That makes Autodiscover DNS the whole game. Outlook tries a fixed sequence: the Active Directory service connection point if the PC is domain-joined, then https://domain.com/autodiscover, then https://autodiscover.domain.com/autodiscover, then an HTTP redirect check, then an SRV record, and for Microsoft 365 accounts a direct lookup against Microsoft's own endpoint.
In hybrid, the on-prem server answers first and redirects moved users to Exchange Online with their routing address, so profiles follow the mailbox automatically. Outlook shows the message that the administrator made a change and asks for a restart. After a cutover, the old server or the SCP in Active Directory may still answer, hand out on-prem settings, and leave the user stuck.
The registry keys that control it
Outlook reads a handful of values under the Autodiscover key in the current user's Office hive. The two that matter most after a migration are ExcludeScpLookup, which stops Outlook asking Active Directory for the old server, and ExcludeExplicitO365Endpoint, which must not be set to 1 because it disables the direct Microsoft 365 lookup. If someone set exclusions during an earlier troubleshooting session, they will still be there.
For a cutover where directory sync is off and Active Directory still holds the old Exchange SCP, set ExcludeScpLookup to 1 through Group Policy or Intune for all users. In hybrid, leave it alone until the last server is gone.
Test from a workstation with the Test E-mail AutoConfiguration tool: hold Ctrl, right-click the Outlook icon in the system tray, and run it with only the Autodiscover box checked. The log tab shows every URL tried and which one answered.
reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\AutoDiscover"
reg add "HKCU\Software\Microsoft\Office\16.0\Outlook\AutoDiscover" /v ExcludeScpLookup /t REG_DWORD /d 1 /f
reg delete "HKCU\Software\Microsoft\Office\16.0\Outlook\AutoDiscover" /v ExcludeExplicitO365Endpoint /f
reg delete "HKCU\Software\Microsoft\Office\16.0\Outlook\AutoDiscover" /v ExcludeHttpsAutoDiscoverDomain /fZeroConfigExchange: profiles with no prompts
ZeroConfigExchange tells Outlook to create the profile from the signed-in user's identity without asking anything. Set it to 1 under the same Autodiscover key, and the first time Outlook starts with no profile, it takes the user's UPN, runs Autodiscover, and opens the mailbox. Combined with Entra joined or hybrid joined devices and the Microsoft 365 apps, the user sees a sign-in prompt at most.
It relies on the UPN being the same as the primary SMTP address. If your Active Directory still uses a .local suffix or the UPN differs from the email address, fix that in the identity work before the migration or the profile is created for the wrong address. The old PRF file method is gone; policies and this key replace it.
A practical rollout is a Group Policy preference or Intune setting that writes ZeroConfigExchange and the exclusions, plus a small script that renames the old profile so Outlook starts fresh.
reg add "HKCU\Software\Microsoft\Office\16.0\Outlook\AutoDiscover" /v ZeroConfigExchange /t REG_DWORD /d 1 /f
# Retire the old profile so a new one is created at next launch
$p = "HKCU:\Software\Microsoft\Office\16.0\Outlook\Profiles"
Get-ChildItem $p | ForEach-Object { Rename-Item $_.PSPath "$($_.PSChildName)_old" }
Remove-ItemProperty "HKCU:\Software\Microsoft\Office\16.0\Outlook" -Name DefaultProfile -ErrorAction SilentlyContinueWhat else changes on the desktop
A new profile means a new OST file. Every PC downloads the mailbox again, which on a small office connection with 150 users is a real amount of data on the same morning. Set the cached mode sync slider to a few months through policy for the first week, then widen it. Users with archived mail can search the Online Archive live; it is never cached.
Signatures survive because they live in the user's AppData, but the default signature assignment is per profile and resets. Autocomplete addresses are stored in the mailbox now and come back. Shared mailboxes with automapping appear on their own. Additional mailboxes that were added by hand, PST files that were attached, and rules that ran client-only have to be re-added. Tell users in advance which of these apply to them.
- OST re-download: throttle with the cached mode slider on day one.
- Default signature: reassign per user.
- Manually added mailboxes and PST files: re-add.
- Client-only rules: recreate; server rules move with the mailbox.
- Legacy X500 addresses: keep them on the cloud mailbox or replies to old messages bounce.
New Outlook and mobile
The new Outlook for Windows and Outlook on the web have no profile in the classic sense. The user signs in and the mailbox appears. If part of your fleet is moving to new Outlook anyway, cutover day is a good moment, since there is nothing to migrate in the client. Outlook for iOS and Android behave the same way: remove the account, add it again with the email address, done. The native mail apps on phones are the ones that keep old server settings and need to be removed and re-added by hand.
Frequently asked questions
Why does Outlook keep connecting to the old server after a cutover?
The Active Directory service connection point still points there and Outlook checks it first on domain-joined PCs. Set ExcludeScpLookup to 1, or remove the SCP, and rebuild the profile.
Do I have to delete the old profile?
In hybrid, no, Outlook updates it. In cutover or IMAP migrations, yes. Renaming the profile key in the registry is enough for Outlook to build a new one at the next launch.
Can I push these settings with Intune?
Yes. Use the Office administrative templates in the settings catalog or a custom OMA-URI for the registry values. Group Policy preferences work the same way for domain-joined machines.
Takeaway
Outlook profiles at scale come down to Autodiscover DNS being right, the SCP and exclusion keys not pointing at the past, and ZeroConfigExchange building profiles without prompts. Push the keys by policy, rename old profiles by script, and warn users about OST downloads and re-added mailboxes. Nobody should be typing server names into two hundred PCs.