Possible to have a cloud primary mailbox with an on-prem archive mailbox

As of this time, this can only be done by adding the shared mailbox to Exchange as either a normal remote mailbox, or a contact.

There is a user voice post about adding this feature from September 2015, and is not yet implemented.

Vote now! https://office365.uservoice.com/forums/273493-office-365-admin/suggestions/9703716-create-new-remote-shared-mailboxes-from-hybrid

It could just be the implementation of the CMDLET and how it is negotiating the connection. Your endpoint is configured with Negotiate, so the client and server should decide if you are using kerberos or NTLM. In your failed attempt it did not detect either correctly, and tried to fall back to Basic Auth - which your server is not configured to support.

NTLM does not support the UPN format, and you did not have a kerberos ticket, so this could be the reason. You generally don't run into this with Windows clients/servers often as most applications seem to take care of reformatting the username reqeust. However if your samAccountName and UPN pre-fix are different then the credentials won't match.

I would be sure your samAccountName and UPN prefixes match on the account. If not, or if they still fail, you should be able to enable basic auth on EWS. This should allow it to fall back on the client side and be accepted on the server side. Since this is an O365 connection, I think we can assume safely your already using HTTPS - which of course is critical if your using Basic Auth as the credentials are sent in plan text.