The Mailbox Replication Service (MRS) has a proxy endpoint that's required for cross-forest mailbox moves and remote move migrations between your on-premises Exchange organization and Microsoft 365 or Office 365.
If you have enabled the MRS proxy endpoint in the Exchange Web Services (EWS) virtual directory settings on Exchange 2016 or 2019 Mailbox servers, and that you have also enabled DualShield MFA on the EWS application node, then you need to add the following exemption.
In the IIS Manager, select the "EWS" application node:
Click "DualShield Authentication" to launch the "DualShield IIS Agent" control panel:
In the DualShield IIS Agent control panel, click "URL Filter" button
Click the "Add" button
In the "URL" box enter "/EWS/MRSProxy.svc"
Click "OK" to save it
Click "OK" to finish it
Finally, click "Apply" to apply the changes.