Exchange Hybrid Config

[Simcfc73]

Hi,

 

I'm dabbling in migrating some mailboxes to exchange online and after a failed attempt (my test account had an online archive which messed everything up) I have few mailboxes online.

 

 

I use app proxy on site with my exchange server so connecting doesnt seem to be straightforward so I am just wondering how if anyone has a hybrid and how they configure access to OWA.. should it connect to both online and on site OWA sites from the same URL? Also, how do you configure microsoft outlook, is there some fancy dancy way to connect to o365 when using hybrid.

 

 

Cheers for the help.

[chaplic]

If you access your on-prem OWA server with an account that the mailbox is on the cloud, it literally tells you to click on https://outlook.office365.com

[Simcfc73]

I thought because I was using app proxy it didn't work but it does what you say.. thanks.

 

 

Absolute nightmare moving my first one, I ended up with 2 mailboxes, one int he cloud and one on site so had to powershell to remove the online account from the recycle bin before it synced.

[chaplic]

If it's any consolation when I'm doing mailbox moves it usually takes several hundred or even thousands to be a slick, reliable operation

[Simcfc73]

Weirdness is happening.

 

I migrated my test account and my admin account with success and outlook pointed to the O365 fine.. I removed my Outlook account on my windows phone and it reattached perfectly to O365.

 

Problem is when I tried my laptop at home which wont attach.. and now my work Outlook account has stopped working.

 

Running Remote connectivity thingy its showing as Host *****.mail.onmicrosoft.com couldn't be resolved in DNS InfoNoRecords.

[chaplic]

the .mail.onmicrosoft.com is a construct used to get mail in between your on prem environment and o365 and help with autodiscover. If you look at the targetAddress field in AD for migrated accounts you'll see it listed.

 

There is no DNS A record for this value but there is for autodiscover.nike.mail.onmicrosoft.com (I picked nike out of thin air, substitute for your tennant name). So that might be a spurious error, assuming that this resolves for you

 

What should be happening is your DNS records on the internet still refer you to your on premise exchange, that sniffs on the targetAddress and sends outlook on a merry dance of trying to find an autodiscover server, ending up getting success at autodiscover-s.outlook.com

 

Can you shift and right click on the outlook icon in bottom right, select test autodiscover, put in your email address, untick use guesssmart and secure guesssmart. Don't put your password in, then select test. That may give us a few clues if you want to post it

 

Other things - the autodiscover process will respect proxy settings. Has anyone every set any limits on autodiscover in registry keys

https://support.microsoft.com/en-gb/help/2212902/unexpected-autodiscover-behavior-when-you-have-registry-settings-under

 

Finally, I would not recommend this as a solution as you need to get to the bottom of it, but outlook 2016 essentially ignores all of the above and connects to o365 to see if you have a mailbox anyway, so a helpful troubleshooting step.

[Simcfc73]

Thanks for this, it looks like its something to do with MFA which is enabled. As soon as I disabled it for my test account it worked fine but I am getting a prompt to sign in each time with my @DomAin which i presume is to sign into Office365... this doesnt have a save password option whioch will eb a pain for staff.

 

I'm a bit confused as to how MFA will work now with Outlook. We are all Office 2016 in school so I thought MFA would just work without having to sort out app passwords. At home before I disabled MFA it never worked even when I deleted the outlook profile.

 

I was hoping I could use the trusted IP bit of Azure MFA to bypass MFA for the intranet.

 

Edit : Looking at the Azure logs I am getting

 

Failure reason - User did not pass the MFA challenge (non interactive).

Client App - Exchange ActiveSync

Edited August 1, 2018 by Simcfc73

[chaplic]

Aha. MFA will work well with Outlook 2016 and you don't need app passwords. You are correct that with the correct config you won't need to do MFA internally, either by specifying trusted IPs (assuming they are fixed) or using the 'insidecorporatenetwork' claim assuming you're using ADFS. But one thing at a time

 

Assume access to webmail (inc MFA) is OK exernally?

 

it sounds like outlook 2016 isn't trying to do modern authentication, which it should be out of the box. Would someone have disabled it?

 

Take a look at client settings (this refers to 2013 so look at 16)

 

https://support.office.com/en-us/article/enable-modern-authentication-for-office-2013-on-windows-devices-7dc1c01a-090f-4971-9677-f1b192d6c910

 

Also, i'd think it's enabled in your tennant but also verify

 

https://support.office.com/en-gb/article/enable-or-disable-modern-authentication-in-exchange-online-58018196-f918-49cd-8238-56f57f38d662

 

Finally, have you done anything with Conditional Access?

[Simcfc73]

Running this it was set to false

 

Get-OrganizationConfig | Format-Table -Auto Name,OAuth*

 

I never disabled it but will do some more testing now.

 

Cheers

[Simcfc73]

one final thing which i am struggling with. (In menorca so hard to fix)

 

traffic between on site and cloud, what sites on the firewall have you opened. i did the sites on herehttps://support.office.com/en-us/article/office-365-urls-and-ip-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2 but its not sending mail from the cloud to onsite.