Error configuring OAuth from Exchange 2016 (AADSTS700027)

Question

Hi,
I'm in the process of configuring OAuth from en on-premises Exchange 2016 CU19+ install to in order to have calendar integration within Microsoft Teams.
The HCW wizard has completed successfully, but no calender tab is visible within the Teams client (thick or web - same issue).

I've tested with

Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox mailbox@localdomain.tld 

And the error is

AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: xxxxxxxxx

I've tried verifying the certificate used for OAuth and it looks OK.

Running this command I've saved the certificate and compared it to the thumbprint from get-authConfig - they match and have not expired

Get-MsolServicePrincipalCredential -ServicePrincipalName "00000002-0000-0ff1-ce00-000000000000" -ReturnKeyValues $true

I'm kind of stumped as to how to solve this issue.

Answer 1

Run through the troubleshooter:
https://learn.microsoft.com/en-us/microsoftteams/troubleshoot/known-issues/teams-exchange-interaction-issue

and test here:
https://testconnectivity.microsoft.com/tests/TeamsCalendarMissing/input

Answer 2

Wow! That was quick.

I've already tried the test connectivity, and that gives the following error

The specified user mailbox is marked as undiscoverable by the Teams middle-tier service.

Running through the troubleshooting tips from https://learn.microsoft.com/en-us/microsoftteams/troubleshoot/known-issues/teams-exchange-interaction-issue
I get to step number two
Invoke-RestMethod -Uri "https://autodiscover.domain.tld/autodiscover/autodiscover.json?Email=mymailbox@keyman .tld&Protocol=EWS&RedirectCount=5" -UserAgent Teams

Running it from a computer within the domain I get the following error

Running the same command from a computer outside of the windows domain, it completes as expected

Answer 3

Hmmm, I wonder if you should open a ticket with 365 support. I havent seen that one before

Answer 4

Doing the invoke-restmethod failed, but I've tried the same URI from a regular browser, and that completes as expected

I was looking through the next step, https://testconnectivity.microsoft.com/tests/TeamsCalendarMissing/input
but cannot quite figure out how to do it as I have NO on-line mailboxes. Only On-premises.

We actually do not need the hybrid configuration - only OAuth, but that is the supported way of configuring it so we completed the HCW.

Answer 5

Check below links may help:
https://github.com/pnp/cli-microsoft365/issues/1532
https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/exchange-oauth-authentication-could-not-find-the-authorization
https://social.technet.microsoft.com/Forums/windows/en-US/58249c8d-c8be-4b28-88fe-a23899d1b8d3/server-error-code-invalidclient-description-aadsts700027-client-assertion-contains-an?forum=Exch2016SD