Query OnPremise AD for Specific AD attributes not working?

PowerShell Help
6

Update for the OP

After getting back to my test environment, the below works for the use case.

Get-ADUser -Filter * -Properties msExchRemoteRecipientType,proxyAddresses,msExchRecipientDisplayType,msExchRecipientTypeDetails | 
Where-Object {($_.msExchRemoteRecipientType -eq 4) -and
  ($_.proxyAddresses -match "onmicrosoft.com") -and
  ($_.msExchRecipientDisplayType -eq '-2147483642') -and
  ($_.msExchRecipientTypeDetails -eq '2147483648')
}

Also, correction, not that you need it for what you are after, since the proxyAddresses return the same thing, when you hit that remote O365 mailbox, you do get a targetAddress property, it’s just not on the on-prem mailboxes, hence the reason, the proxyAddresses may be more prudent for you to use for consistency.

Get-ADUser -Filter * -Properties msExchRemoteRecipientType,proxyAddresses,targetAddress,msExchRecipientDisplayType,msExchRecipientTypeDetails | 
Where-Object {($_.msExchRemoteRecipientType -eq 4) -and
  ($_.proxyAddresses -match "onmicrosoft.com") -and
  ($_.targetAddress -match 'onmicrosoft.com') -and 
  ($_.msExchRecipientDisplayType -eq '-2147483642') -and
  ($_.msExchRecipientTypeDetails -eq '2147483648')
}