Autodiscover is Hero of Exchange Motherland! Jeff Guillet, MVP | MCSM | CISSP

Why is Autodiscover Important? Autodiscover is more than just a convenience Required for EWS, availability, OOF Required by Mac for Outlook Used by scripts and applications Used by auto-mapping #ITDevConnections

What does it do for me? You have no choice – you might get mail to work, but Availability, OOF, EWS, etc. won’t work without it. Autodiscover provides Outlook with several key pieces of information: Outlook Anywhere also includes SSL requirement and Certificate Principal Name Display Name Server/Outlook Anywhere End Point/RPC CAS Alias Availability Service URL OOF URL AOB URL or Location Unified Messaging URL, if appropriate OWA URL ECP URL Authentication Package Alternate Mailboxes Archive Access Public Folder Access #ITDevConnections

How does it work? Autodiscover is a web service Authenticated client posts web request Autodiscover service returns XML response Response comes from mailbox server and is dynamic, based on client and location Configures Outlook or mobile client Configures URLs for each service based on location #ITDevConnections

Autodiscover Requirements Internally, Exchange publishes an SCP during setup Externally, you need the following to get it working: Enable Outlook Anywhere SSL Certificates Configure URLs for each service Publish URLs in external DNS #ITDevConnections

How do Clients Connect to Autodiscover? Authentication Assumes username + @ + domain portion of the user’s primary SMTP address (SMTP domain) Otherwise uses Outlook's Auto Account Setup or prompts for logon ID Domain password Best practice: Match logon ID to email address Password policy implications Denials of Service #ITDevConnections

Autodiscover 2010 Internal Architecture The XML request contains a reference to a schema as the first part of the opening <Autodiscover> XML tag xmlns=https://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006a xmlns=https://schemas.microsoft.com/exchange/autodiscover/mobilesync/requestschema/2006a #ITDevConnections

Autodiscover 2013 Internal Architecture The XML request contains a reference to a schema as the first part of the opening <Autodiscover> XML tag xmlns=https://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006a xmlns=https://schemas.microsoft.com/exchange/autodiscover/mobilesync/requestschema/2006a #ITDevConnections

Anatomy of an Autodiscover Response Schema (outlook or mobilesync) User Information Account Information Alias Protocols: EXCH, EXPR, EXHTTP, WEB and sometimes mapiHttp Encryption Authentication URLs Alternative Mailboxes Public Folder Information Exchange 2007\2010: EXCH = Internal Outlook provider; EXPR = External Outlook provider Exchange 2013\2016: EXCH = EWS; EXPR = EWS; EXHTTP = Both, Internal then External WEB = URL for Outlook Web Access EXPR = Exchange HTTP protocol for OA (web services) EXHTTP = #ITDevConnections

Outlook Anywhere 2010 Response Exchange Availability Service OOF OAB, and below that is UM #ITDevConnections

Outlook Anywhere 2010 Response 4. Protocol – in this case Outlook Anywhere 5. RPC Proxy server 6. Encryption requirement 7. Type of authentication – mutual means AutoD service uses cert, and user uses password 8. Certificate Principal Name (msstd) – server name (5) must match #ITDevConnections

MAPI over HTTP Response #ITDevConnections

MAPI over HTTP Response #ITDevConnections

How Does Internal Outlook Connect to Autodiscover? Internal Autodiscover (domain-based) Service Connection Point (SCP) AD site-based First server in AD site SSL encrypted, so FQDNs and certs matter! #ITDevConnections

How Does External Outlook Connect to Autodiscover? External Autodiscover (everywhere else) Publish Autodiscover URL in DNS A record CNAME record SRV record SSL encrypted, so FQDNs and certs matter! #ITDevConnections

Outlook Order of Operations SCP lookup HTTPS root domain query HTTPS Autodiscover domain query Local XML file HTTP redirect method SRV record query Cached URL in the Outlook profile (new for Outlook 2010 version 14.0.7140.5001 and later versions) Direct Connect to Office 365 (new for Outlook 2016 version 16.0.6741.2017 and later versions) #ITDevConnections

Mobile Devices Only once (usually) during initial config Different customized response HTTP Error 451 redirect does not use Autodiscover #ITDevConnections

What Makes Outlook Contact Autodiscover? On Outlook startup Periodically on a background thread Default every 1 hour TTL setting (in hours) using Set-OutlookProvider If connection to Exchange server fails (failover or migration) Outlook for Mac requires Autodiscover for normal operation #ITDevConnections

Publishing Autodiscover Internal Publishing SCP Edit with Set-ClientAccessServer -AutoDiscoverServiceInternalUri Best practice is to use the load balanced namespace for all servers External Publishing A records CNAME records SRV records #ITDevConnections

Autodiscover Coexistence Autodiscover URL should always point to latest version 2013 CAS can up-level proxy to 2016 Exchange 2007 coexistence Client  CAS2013/16  MBX2013/16 EX2013/16 delivers Exchange 2007 XML for the correct AD site. Exchange 2010 coexistence Client  CAS2013 (proxy)  CAS2010  MBX2010 Hybrid autodiscover should always point on-prem #ITDevConnections

Autodiscover Testing Exchange Remote Connectivity Analyzer (ExRCA) Microsoft Connectivity Analyzer Outlook Test Email AutoConfiguration #ITDevConnections

Demo Outlook Test Autodiscover, ExRCA, Connectivity tool. Show local logs in C:\Users\Jeff\AppData\Local\Microsoft\Outlook\16

Autodiscover Gotchas Registry or GPO settings cause Autodiscover to misbehave https://support.microsoft.com/en-us/kb/2212902 Ensure autodiscover.domain.com is on your certificate or use a wildcard Set each SCP to the load balanced name on your certificate #ITDevConnections

Set-AutodiscoverSCP Script Prevents Outlook security warnings when building new Exchange servers Copies the SCP to the new AD object Copies all virtual directory URLs to the new server http://bit.ly/autodiscoverscp #ITDevConnections

Autodiscover Tips Beware of bare domain lookups in hosted environments Use Set-AutodiscoverSCP.ps1 for new servers Match UPNs to email addresses Reconfigure automapping Troubleshooting from Outlook (logs) Only use A records, but if you have to use SRV make sure they're consistent Bare domain lookups may be problematic if it has a cert on it. (expired, android). #ITDevConnections

WIN Rate This Session Now! Tell Us What You Thought of This Session Rate with Mobile App: Be Entered to WIN Prizes! Tell Us What You Thought of This Session Select the session from the Agenda or Speakers menus Select the Actions tab Click Rate Session Rate with Website: Register at www.devconnections.com/logintoratesession Go to www.devconnections.com/ratesession Select this session from the list and rate it #ITDevConnections