ARR autodiscover issue

Question

question

MikhailFirsov-1277 asked Nov 10, '20 MikhailFirsov-1277 answered Nov 18, '20

ARR autodiscover issue

Hello,

One more question on ARR, please: my ARR works perfect in proxying OWA connections but yesterday I tried to connect to my Exchange using Outlook Anywhere and failed. The Autodiscover rules have been created automatically by the ARR setup and the monitoring test displays OK:

For testing purposes I tried to access the same page - https://autodiscover..../Autodiscover/HealthCheck.htm - from internet and I got the 404 error (the https://mail.domain.../owa works ok). I then tried to make the three consecutive (external) connections to autodiscover.mydomain.com (via ARR) and see what the IISlog records would reveal:

1) I run Outlook - it fails, the connection is logged
2) I connect to https://autodiscover..../Autodiscover/HealthCheck.htm - erro, this connection never logged!
3) I connect to https://mail.domain.../owa - connects ok, logged.

Would anyone please explain to me

1) why does Outlook tries to connect using port 80 and not 443?
2) why does the connection to https://autodiscover..../Autodiscover/HealthCheck.htm never get logged?

And is there any other documentation on ARR except this?

The rules:

Seems ARR does not see any connection attempts to autodiscover.domain.com site:

Thank you in advance,
Michael

office-exchange-server-administration office-exchange-online-itpro office-exchange-server-mailflow office-exchange-server-connectivity office-exchange-server-itpro

03.png (61.5 KiB)

05.png (29.4 KiB)

08.png (25.2 KiB)

10.png (113.9 KiB)

02.png (75.4 KiB)

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KaelYao-MSFT · Nov 11, 2020 at 09:34 AM

Hi,Michael.
Have you tried the Test E-mail AutoConfiguration feature of Outlook client and the EXRCA tool to test autodiscover?
And what version of ARR are you using?

In addition,I suppose you may have already read the part2 and part3 articles from the exchange tech blog.
Here is another document from TechNet gallery for your reference: Application Request Routing for Microsoft Exchange Server

0 ·

Answer 1 · 2020-11-18T08:27:21.14Z

MikhailFirsov-1277 answered Nov 18, '20

P.S. The answer - the Basic authentication must be enabled for the autodiscover virtual directory of the autodiscover.domain.com site.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2020-11-11T09:48:04.647Z

MikhailFirsov-1277 answered Nov 11, '20

Hi KaelYao-MSFT,

"Have you tried the Test E-mail AutoConfiguration feature of Outlook client and the EXRCA tool to test autodiscover?" - no, I can't use them as my Exchange is located in the network wich has not public dns records (the research network), for testing external access I'm using the hosts files. But if I turn off ARR the external connection to https://autodiscover..../Autodiscover/HealthCheck.htm works correctly. Thank you for the article - will be reading now.

ARR 3.0.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2020-11-12T13:36:58.69Z

MikhailFirsov-1277 answered Nov 12, '20 MikhailFirsov-1277 edited Nov 12, '20

Please excuse me for asking on autodiscover instead of ARR but that's solely for the purpose of not creating another thread.
I disabled ARR and added the simple port forwarding to test the autodiscovery:

My goal was to see whether my Outlook does really try to connect to the EXCH1's Autodiscover virtual directory or not.
Here are the results:

1) I manually connect to https://autodiscover.mydomain/Autodiscover/Autodiscover.xml

2) Although it's clear that I have connected to the Autodiscover virtual directory I make sure the new incoming port mapping has been added in RRAS:

3) On the same workstation (NOT domain-joined!) I run Outlook and manually type my email:

4) After ~20 second the process ends with this window:

5) Back to the mappings - no incoming mapping appears...

...so as far as I understand it Outlook does not even try to connect to my autodiscover.mydomain/Autodiscover and does not throw any warning or error windows. But when ARR is running I at least see the connection attempts in the ARR's log ... ??? Now I am a bit at loss here - what else can I do in this situation?

Thank you in advance,
Michael

30.png (38.1 KiB)

25.png (46.1 KiB)

28-1.png (28.9 KiB)

24.png (11.7 KiB)

27.png (16.0 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2020-11-12T13:42:07.42Z

MikhailFirsov-1277 answered Nov 12, '20 KaelYao-MSFT commented Nov 13, '20

P.S. Both mail.mydomain.com and autodiscover.mydomain.com resolve correctly by means of hosts files.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KaelYao-MSFT · Nov 13, 2020 at 08:01 AM

Hi,Michael.
If autodiscover.mydomain.com can be successfully resolved on the workstation via hosts files,I think the "est E-mail Autoconfiguration" feature of Outlook can be used for troubleshooting.

Here are the steps:
1.press Ctrl and right click on the Outlook icon in the notification area,select "Test E-mail Autoconfiguration"

2.input your account and password,select "Use Autodiscover"

3.the results can be seen under the "Results" and "Logs" tags

Please have a try and see if some detailed information can be found.

0 ·

1.jpg (18.6 KiB)

2.png (8.2 KiB)

3.png (21.1 KiB)

Answer 5 · 2020-11-13T10:28:56.813Z

MikhailFirsov-1277 answered Nov 13, '20 KaelYao-MSFT edited Nov 16, '20

Hi KaelYao-MSFT,

Hmm, but doesn't the "Test E-mail Autoconfiguration" feature gets available by clicking on the Outlook item only AFTER Outlook has previously managed to connect using autodiscover? As I can't connect using the "Exchange" option I've created the IMAP profile, but there's no "Test E-mail Autoconfiguration" option for Outlook item in this case :(
I

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KaelYao-MSFT · Nov 16, 2020 at 01:34 AM

Hi,Michael.
but doesn't the "Test E-mail Autoconfiguration" feature gets available by clicking on the Outlook item only AFTER Outlook has previously managed to connect using autodiscover?
This feature is used to test whether Outlook can connect to the Autodiscover service on an Exchange server successfully.
It doesn't need Outlook to have connected to it successfully previously.

Meanwhile,this feature can be used without an account configured(choose "Use Outlook without an email account" when setup)
But I think a IMAP profile should also be fine.

Did you press Ctrl and right click on the Outlook icon?

0 ·

Answer 6 · 2020-11-16T13:28:58.253Z

MikhailFirsov-1277 answered Nov 16, '20 MikhailFirsov-1277 edited Nov 16, '20

Oh, sorry - forgot CTRL.
Yes, the Test E-mail Autoconfiguration works correctly... because it DOES ASK for user credentials like any browser does when manually navigating to the https://autodiscover.../autodiscover.xml, but Outlook did NOT ask for credentials - that was the problem.

There's something I can't understand: by default after creating the new autodicover site it has the following authentication settings:

As you see Basic authentication is NOT enabled - neither in EAC nor in IIS - although this page says the opposite:

-BasicAuthentication
The BasicAuthentication parameter specifies whether Basic authentication is enabled on the virtual directory. Valid values are:
$true: Basic authentication is enabled. This is the default value.
$false: Basic authentication is disabled.

Nevertheless even with those settings both a browser and the Outlook's Test Email configuration do throw authentication dialog (as posted above), but Outlook itself does not. After enabling Basic authentication in IIS Outlook start asking user credentials and all works correctly so

1) Why does Outlook behaves differently when it starts the autodiscovery process by itself?

2) Outlook Anywhere starts working when the Basic authentication gets enabled in IIS but NOT in ECP - is it normal?

3) As far as I understand it is the Basic authentication that makes the authorisation window pop up - when the Basic was disabled what made that authorisation window appear?

Regards,
Michael

05.png (73.2 KiB)

9.png (122 B)

9.png (8.9 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 7 · 2020-11-17T14:45:08.817Z

MikhailFirsov-1277 answered Nov 17, '20 KaelYao-MSFT edited Nov 18, '20

Thank you all for your help - it works!

Regarfs,
Michael

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KaelYao-MSFT · Nov 18, 2020 at 12:51 AM

Hi,Michael.
Glad to hear that you have found the solution!
By default the basic authentication on the Autodiscover virtual directory should be enabled. Not sure why it was disabled.

Please be free to mark your reply as the answer to the question.
It will make answer searching in the forum easier and be beneficial to other community members as well.

0 ·

Answer 8 · 2020-11-18T08:25:36.513Z

MikhailFirsov-1277 answered Nov 18, '20

Hi KaelYao-MSFT,

"By default the basic authentication on the Autodiscover virtual directory should be enabled. " - yes, it's enabled for the Default Web site, but I'm using another site (autodiscover.....net) and it did not have the Basic authentication enabled after the creating the site :(

Regards,
Michael

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question