Hybrid deployment configuration changes may require you to modify security settings for your on-premises network and protection ...

Hybrid deployment configuration changes may require you to modify security settings for your on-premises network and protection solutions. Client Access servers must be accessible on TCP port 443, and Hub Transport servers must be accessible on TCP port 25. Other %BRAND_OFFICE_365_SHORT% services, such as %BRAND_SHAREPOINT% and %BRAND_LYNC_ONLINE%, may require additional network security configuration changes. If you're using %BRAND_MICROSOFT% Threat Management Gateway (TMG) in your on-premises organization, additional configuration steps will also be needed to allow full %BRAND_OFFICE_365_SHORT% integration in the hybrid deployment.