Recent Discussions
Exchange Online PowerShell Updates to 3.10.1 to Fix CBA
Microsoft rushed out version 3.10.1 of the Exchange Online management PowerShell module to fix a problem with certificate-based authentication. It seems like a change in an internal Microsoft identity platform caused the tokens issued after a successful connection to Exchange Online to not authorize the execution of further cmdlets. To their credit, Microsoft fixed the issue, but is this the kind of thing that should be caught in testing? https://office365itpros.com/2026/07/27/exchange-online-management-3-10-1/
Apple Mail EWS sync intermittent after EwsEnabled=True + AppID allow list
We're a small Microsoft 365 Business tenant (Exchange Online Plan 1/2 mix). One user's Apple Mail (macOS, Exchange/EWS account) intermittently stops syncing new mail — Connection Doctor shows a healthy green "Connection and login to server succeeded," but Get New Mail/manual fetch and forced Sync All Accounts return nothing new, while the same mail is already present via ActiveSync on the same user's iPhone/iPad. Symptoms recur every 1–3 days after temporarily resolving. Troubleshooting completed so far: - Confirmed autodiscover/External URL correctly resolves to outlook.office365.com/EWS/Exchange.asmx - Confirmed EWS enabled at the mailbox level (Manage email apps in admin center) - Found EwsEnabled was blank/null at the org level — set to $true via Set-OrganizationConfig - Configured EwsAllowedAppIDs to include Apple's app ID (f8d98a96-0999-43f5-8af3-69971c7bb423, "Apple Internet Accounts") - Fully removed and re-added the Mac Mail account after the above org-level change - Restarted the Mac, tried DNS changes (8.8.8.8/8.8.4.4), ruled out router-level filtering - Verified no antivirus/VPN/security software on this Mac's network Despite all this, the issue persists intermittently. Notably, a second mailbox on the same tenant, used with Apple Mail on a different Mac (different macOS version, different physical location/network), does NOT experience this issue — so it doesn't appear to be a blanket tenant-wide EWS disruption. Given Apple Mail's continued reliance on EWS ahead of the October 2026 phased disablement, and Microsoft's acknowledgment that Apple Mail for Mac is a heavy EWS consumer they're working with Apple to migrate to Graph, I'm wondering: 1. Could this be related to the ongoing "scream test" EWS disruption testing Microsoft has mentioned, and if so, is there a way to check whether a specific mailbox has been included in that testing? 2. Any known differences in EWS session/connection handling between macOS versions that could explain one Mac being affected and not the other? 3. Anything else worth checking tenant-side (throttling policies, CAS mailbox settings, conditional access rules) that could apply per-mailbox rather than tenant-wide? Happy to provide EWS usage report data or run any diagnostic commands if it helps others hitting the same thing before October.
account only remote wipe device
Hello, My o365 account is E3. My phone is android, I installed outlook on my phone. I tested to wipe the outlook on my phone with my admin account, but after I click the "account only remote wip1e device", it showed "Saving in progress", then showed a red "X". The client is Outlook for iOS and Android, client type is outlook not EAS. Do I need more steps to wipe outlook on my phone? or a role/permission is missed? Thanks and regards, AdsnowReference Architecture for an On-Premises AI Assistant for Microsoft Exchange.
Bringing Secure AI Capabilities to On-Premises Microsoft Exchange Many organisations continue to operate Microsoft Exchange within their own data centres because of regulatory requirements, data-residency policies, security considerations, operational dependencies, or the need to maintain complete control over sensitive email information. At the same time, users increasingly expect Artificial Intelligence to help them manage growing email volumes, understand long conversation threads, locate information quickly, analyse attachments, and prepare relevant responses. This creates an important question: Can organisations introduce AI-assisted email capabilities without migrating their on-premises Exchange environment or sending email data to public AI services? With the right architecture, the answer is yes. The opportunity for AI in on-premises Exchange Users spend a significant amount of time reading lengthy email chains, searching for previous discussions, identifying action items, reviewing attachments, and preparing responses. An AI-powered email assistant can help reduce this effort while continuing to operate within the organisation’s controlled infrastructure. Such a solution can be integrated with Microsoft Exchange through an Outlook Web App, or OWA, Add-In. The Add-In provides AI-assisted capabilities within the familiar Outlook Web interface and can be centrally deployed to selected users or Active Directory groups by the Exchange administrator. The purpose is not to replace Exchange or change the way emails are managed. Instead, it introduces an intelligence layer that helps authorised users interact more efficiently with the email information they are already permitted to access. Key capabilities of an AI-powered Exchange Email Assistant 1. Email and conversation summarisation The assistant can summarise an individual email or an entire conversation thread. Instead of reading every message in a long chain, the user can receive a structured summary covering: The purpose of the conversation. Important decisions and commitments. Key action items. Deadlines and pending responses. Relevant information available in attachments. The summarisation process can consider both incoming and sent messages so that the complete context of the conversation is preserved. 2. Contextual draft reply generation The assistant can prepare a suggested response based on the complete email thread and the user’s instructions. Users may select an appropriate tone, such as: Formal. Neutral. Technical. The generated response is placed in the user’s Exchange Draft folder or displayed for review within the OWA Add-In. A critical control is that the AI assistant does not independently send the email. The user remains responsible for reviewing, editing, approving, and sending the response. This human-review approach helps organisations adopt AI while retaining accountability over external and internal communications. 3. Natural-language mailbox search Traditional mailbox search generally depends on exact keywords, sender names, subjects, or date filters. An AI-enabled search experience allows users to search their mailbox using natural-language questions, such as: “Find emails received last month regarding the infrastructure renewal.” “Show unread emails from the finance team that require my approval.” “Find the discussion where the customer confirmed the delivery date.” “Summarise emails from a particular sender concerning the purchase order.” The solution can combine semantic search with traditional keyword-based search to improve the relevance of results. Users can also apply filters such as sender, subject, date range, read or unread status, and conversation thread. 4. Attachment analysis and OCR Important information is often contained within email attachments rather than the email body itself. An on-premises AI assistant can process supported documents, including: PDF files. Microsoft Word documents. Microsoft Excel files. Scanned documents. Image-based attachments. Optical Character Recognition, or OCR, can be used to extract information from scanned or image-based documents. The extracted content can then support email summarisation, contextual draft generation, and mailbox search. For example, a user may ask the assistant to prepare a response based on the commercial terms or delivery date mentioned in an attached document. Maintaining strict mailbox privacy Mailbox privacy is one of the most important architectural considerations for an enterprise AI email assistant. Each user must only be able to access and process emails from their own authorised mailbox. Information retrieved from one user’s mailbox must never become available to another user. This isolation should be enforced across every layer of the solution, including: User authentication. Exchange access tokens. Application sessions. Search indexes. Vector embeddings. AI prompts and responses. Cache and temporary data. Audit logs. The backend should validate the authenticated user and verify mailbox ownership for every request made to Exchange. Where vector search is used, mailbox data should be stored in user-isolated collections, partitions, or namespaces. This helps prevent cross-user retrieval at the data layer rather than relying only on controls within the user interface. Operating without public cloud AI services For organisations with strict security or data-sovereignty requirements, the AI models and supporting components can be deployed within the customer’s infrastructure. A fully on-premises architecture may include: A locally hosted Large Language Model. An on-premises embedding model. A re-ranking model. A vector database. A keyword-search engine. A backend API layer. An OCR or document-intelligence service. A secured OWA Add-In. Integration with Active Directory. Audit, monitoring, and administrative controls. The entire solution can operate within an internal network without sending email content, attachments, prompts, or generated responses to public AI platforms. This model can also support air-gapped environments where internet access is either restricted or completely unavailable. Centralised deployment and administration The OWA Add-In can be deployed centrally through Exchange administration controls. Administrators can assign the Add-In only to selected users or security groups. Employees who are not assigned the solution will not see the AI assistant within their Outlook Web interface. Administrative controls may include: User and group assignment. Enabling or disabling individual AI features. Summarisation-only mode. Draft-generation controls. Attachment-size restrictions. Session and retention policies. Model and performance settings. Usage monitoring. Audit logs. Resource utilisation monitoring. These controls allow organisations to begin with a limited group of users and gradually extend the solution after validating performance, security, and user adoption. Security and governance considerations Introducing AI into an enterprise email environment requires more than deploying a language model. The complete solution should be designed around security, privacy, governance, and responsible AI principles. Important considerations include: Authentication and authorisation The solution should integrate with the organisation’s existing identity infrastructure, such as Active Directory, and enforce role-based access controls. Encryption Email content, attachments, indexes, logs, and other sensitive information should be encrypted both in transit and at rest. Data retention Organisations should clearly define whether AI prompts, generated summaries, and draft content are retained. In privacy-sensitive environments, generated content may remain available only for the active session and should not be permanently stored by the AI application. Auditability The system should record relevant operational events, such as the user identity, requested function, timestamp, and processing status. Depending on the organisation’s policy, the actual email or generated response content may be excluded from audit logs. Human oversight AI-generated responses should be treated as suggestions. The user must review and approve them before sending. The assistant should also disclose its limitations and avoid presenting uncertain outputs as confirmed facts. Performance and capacity On-premises AI processing depends on available compute, memory, storage, and GPU resources. The architecture should account for: Number of concurrent users. Average mailbox size. Volume and size of attachments. Expected response time. Model size. Search-index growth. OCR processing requirements. High availability and backup requirements. A practical adoption approach Organisations do not need to introduce all capabilities at once. A controlled proof of concept can begin with a limited number of users and a defined set of features. A practical implementation sequence may include: Phase 1: Email summarisation Start with individual email and conversation-thread summaries. This provides immediate value while keeping the initial architecture relatively focused. Phase 2: Contextual draft replies Introduce draft generation with mandatory user review and clearly defined tone controls. Phase 3: Attachment processing Enable OCR and document parsing for supported attachments. Phase 4: Intelligent mailbox search Index authorised mailbox content and introduce natural-language search with strict per-user isolation. Phase 5: Wider deployment After security testing, performance validation, and user feedback, extend the solution to additional departments or user groups. Conclusion Organisations operating on-premises Microsoft Exchange do not necessarily need to choose between maintaining control over their email environment and adopting AI-assisted productivity capabilities. A carefully designed on-premises AI email assistant can support email summarisation, contextual draft preparation, attachment analysis, and natural-language mailbox search while keeping sensitive information within the organisation’s infrastructure. The most important success factors are not limited to the AI model itself. Identity controls, mailbox isolation, human approval, auditing, infrastructure sizing, and data-governance policies are equally important. For organisations evaluating private, sovereign, or air-gapped AI, on-premises Exchange can become an effective starting point for introducing practical AI capabilities in a secure and controlled manner. Connect with us to implement this solution in your organization. About the Author Vinay Prakash is the CEO of Glorious Insight and an Ex Microsoft Employee. He works with organisations on Data, Artificial Intelligence, Microsoft cloud technologies, enterprise applications, and secure on-premises AI solutions. For technical discussions related to private or on-premises AI adoption, he can be reached at: Email: email address removed for privacy reasonsThe Demise of the OWA Light Client
On July 8, Microsoft said that they will retire the OWA Light client for Exchange Server in August 2026. But what happened to the OWA Light client for Exchange Online? It seems like Microsoft announced the retirement of OWA Light for Exchange Online in June 2024, but didn’t really make the fact clear in a blog post about consumer accounts. In any case, you can’t run OWA Light for Exchange Online, even if you wanted to. https://office365itpros.com/2026/07/17/owa-light-retirement/
Exchange 2019 + ADFS is it possible to configure ModernAuth for third-party Android mail clients?
Hello, Our organization operates under Uzbekistan's data localization and banking secrecy regulations, which require customer and corporate data — including email — to remain on infrastructure physically located within the country and under direct regulatory oversight. This precludes the use of cloud-hosted mail services such as Microsoft 365/Exchange Online, and requires a fully on-premises Exchange deployment with local identity federation (AD FS) instead of Azure AD. Environment: Exchange Server 2019 CU14, single server (MX01), pure on-premises. AD FS is registered as an AuthServer (Type: ADFS), no Azure AD / hybrid tenant involved. The AuthServer is configured correctly: AuthorizationEndpoint and TokenIssuingEndpoint are populated, IsDefaultAuthorizationEndpoint: True, and DomainName points to our mail domain. Realm/ServiceName are configured as well. Symptom: The native iOS Mail client (account added manually, no MDM profile) correctly redirects to our AD FS login page on first setup — the full Modern Auth flow works. A third-party EAS client (Nine by NitroDesk, Android) never receives an OAuth challenge at all — it falls back to Basic authentication. Get-ActiveSyncVirtualDirectory/Set-ActiveSyncVirtualDirectory in this build simply has no -OAuthAuthentication parameter (unlike EWS/OAB). Log finding: When testing with the Nine client, the following was captured in the Exchange HttpProxy/Eas logs: S:ServiceCommonMetadata.OAuthError=Flighting is not enabled for domain 'webmail.<domain>'. S:ServiceCommonMetadata.OAuthErrorCategory=OAuthNotAvailable Questions: What exactly controls "Flighting" for EAS OAuth in a pure on-prem Exchange 2019 CU14 + AD FS scenario (no Azure AD)? Is there a documented, supported way to enable it (New-FlightOverride? something else)? Is EAS Modern Auth even supported for an arbitrary/generic OAuth client (not Apple, not Outlook) in this scenario, or is it effectively an allowlist limited to specific client_ids (Apple Native Mail / Outlook)? How does native iOS Mail get redirected to AD FS without ever receiving an authorization_uri in the EAS/Autodiscover 401 challenge — is there an undocumented discovery path (e.g., hardcoded per registered client_id)? Thank you in advance for any insight.Cross-Tenant Message Recall and Duplicate DDG Detection Enhance Exchange Online Messaging
Last week, the Exchange development team announced two interesting developments. Stopping duplicate dynamic distribution groups and cross-tenant message recall. Preventing tenants from creating duplicate DDLs saves service resources and might make tenants easier to manage. The real value is in cross-tenant message recall, which solves a problem by allowing users to recall messages delivered outside their tenant. The facility only works if the receiving tenant allows, but nothing can be done for messages delivered outside Microsoft 365. https://office365itpros.com/2026/07/15/cross-tenant-message-recall/How to Check Distribution Lists for Activity Over the Last 90 Days
The new Get-MessageTraceV2 cmdlet can fetch 90 days of message trace data, which means that we can check for inactive distribution lists using data for the last 90 days instead of being constrained to the last 10 days. This is done by running fetches for nine batches of traffic, each covering ten days. Distribution lists are still important to Exchange Online and Microsoft 365, and it’s good to know which distribution lists are in active use (and how much traffic they get) and which are not. All done with PowerShell. https://office365itpros.com/2026/07/09/inactive-distribution-list-2026/Unauthorized: You don't have permission to access this page or perform this action
I frequently encounter an 'Unauthorized' error when attempting to manage Distribution Lists in the Exchange Admin Center, even while logged in with Global Administrator or Exchange Online Administrator privileges. Is this a known widespread issue, or is it specific to the configuration of these individual tenants?
Exchange Server to Exchange Online Migration: A Pre-Migration Readiness Checklist
Over the years, I have worked on numerous Exchange Server to Exchange Online migration projects alongside Exchange administrators, IT teams, and MSPs. One consistent pattern I have noticed is that most migration issues do not originate during the migration itself — they surface because of gaps in pre-migration readiness. This checklist reflects what I have found most useful before starting any Exchange to Exchange Online migration. Inventory and Assessment Before touching any migration tooling, run a full inventory of your on-premises Exchange environment. This includes the Exchange Server version (2013, 2016, 2019), the number of mailboxes, database sizes, public folders, shared mailboxes, archive mailboxes, and any resource mailboxes such as rooms and equipment. Many teams also forget to document their distribution groups, dynamic distribution groups, and mail-enabled contacts. All of these need to be accounted for before you begin. 2. Active Directory and Entra ID Readiness Check that your Active Directory is clean: no duplicate UPNs, no lingering objects, and no ambiguous legacy Exchange attributes. Verify that Microsoft Entra Connect (formerly AAD Connect) is installed, configured, and synchronizing without errors. Confirm the UPN suffix used in AD matches a verified domain in your Microsoft 365 tenant. Attribute mismatches between on-premises AD and Entra ID are one of the most common causes of post-migration issues with authentication and mail flow. 3. Mail Flow and DNS Document all current MX records and any third-party mail filtering (SEG, anti-spam appliances). Plan whether you will cut over MX during the migration or keep a hybrid mail flow via Exchange connector. Verify SPF, DKIM, and DMARC records are in place for each domain. Applications and devices that use on-premises SMTP relay also need to be identified early — these often get missed and cause disruption after the migration window. 4. Licensing and Tenant Configuration Confirm you have sufficient Exchange Online licenses assigned or ready to assign before the migration starts. Review your tenant for any conditional access policies that may block newly migrated users. Check the Microsoft 365 admin center for any service health issues that could affect the migration window. Also confirm your tenant's default accepted domains and any aliases that need to be added. 5. Coexistence and Hybrid Considerations If you are running a hybrid migration (which is the recommended approach for most organisations with more than a few hundred mailboxes), confirm the Hybrid Configuration Wizard has been run and that the hybrid connector tests pass. Free/busy lookup, OAB distribution, and cross-premises message tracking should all be tested before you move any mailboxes. A common oversight is failing to validate OAuth configuration for modern authentication in hybrid — this affects calendar sharing and delegate access after migration. 6. Data and Backup Before migrating any mailbox, verify that a recent backup of your Exchange databases exists and is recoverable. If you are running a DAG, confirm all database copies are healthy and no replay queues are building up. It is also worth checking the size and age of any archive mailboxes — large archives can significantly extend migration time and should be planned for separately. What patterns have you seen in your environments? Are there specific pre-migration steps that have saved (or cost) you the most time? Happy to discuss further.How to Check Distribution Lists for Activity Over the Last 90 Days
The new Get-MessageTraceV2 cmdlet can fetch 90 days of message trace data, which means that we can check for inactive distribution lists using data for the last 90 days instead of being constrained to the last 10 days. This is done by running fetches for nine batches of traffic, each covering ten days. Distribution lists are still important to Exchange Online and Microsoft 365, and it’s good to know which distribution lists are in active use (and how much traffic they get) and which are not. All done with PowerShell. https://office365itpros.com/2026/07/09/inactive-distribution-list-2026/Impact of Reduced DigiCert SSL Certificate Validity on Exchange Hybrid Environment
DigiCert is reducing certificate validity periods because of new industry requirements approved by the CA/Browser Forum. This is not a DigiCert-only decision all public Certificate Authorities must follow these limits. DigiCert is making this change to align with the CA/Browser Forum’s Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods. This ballot sets a timeline for all Certificate Authorities (CAs) to reduce TLS certificate validity from 398 days to 200 days in 2026, 100 days in 2027, and 47 days in 2029. Impact on Microsoft Exchange Hybrid For environments like Hybrid (Exchange Server SE Hybrid with Edge servers): You'll need to renew your public SSL certificate more frequently. Manual renewal processes will become increasingly difficult. Consider implementing certificate lifecycle automation where supported. Existing certificates remain valid until they expire; the new limits apply to newly issued or renewed certificates. In Hybrid environment (Exchange Server SE, Exchange Hybrid, multiple Mailbox servers, Edge servers, and DigiCert public SSL certificates): No need to rerun the Hybrid Configuration Wizard (HCW) solely because you renewed the SSL certificate, provided the renewed certificate uses the same subject name/SANs and is assigned to the required Exchange services. The primary impact is operational: you'll need a robust and preferably automated certificate renewal and deployment process across your Mailbox servers, Edge servers, and any load balancers to keep pace with the shorter certificate validity periods.
Problem with EMS console, Exchange Toolbox console and permission to serialize tokens
Hi, we setup fresh Windows Server 2025 and install Exchange 2019 with all updates for Server and Exchange. Then we made Upgrade In-Place to Exchange Subscription Edition but problems remained. After installation: Cannot launch "Exchange Toolbox console". Expand console in progress and crash. Error: FX:{714FA079-DC14-470f-851C-B7EAAA4177C1} Type is not resolved for member 'Microsoft.Exchange.Configuration.MonadDataProvider.MonadDataAdapterInvocationException,Microsoft.Exchange.Configuration.ObjectModel, Version=15.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'. Exeption type: System.Runtime.Serialization.SerializationException Exception stack trace: at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessRequest(Request request) at Microsoft.ManagementConsole.Executive.RequestStatus.BeginRequest(IMessageClient messageClient, RequestInfo requestInfo) at Microsoft.ManagementConsole.Executive.SnapInRequestOperation.ProcessRequest() at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(SimpleOperationCallback callback) EMS console. When it runs... VERBOSE: Connecting to ex01.domain.com. New-PSSession : [ex01.domain.com] Connecting to remote server ex01.domain.com failed with the following error message : The WinRM client cannot process the request. It cannot determine the content type of the HTTP response from the destination computer. The content type is absent or invalid. For more information, see the about_Remote_Troubleshooting Help topic. At line:1 char:1 + New-PSSession -ConnectionURI "$connectionUri" -ConfigurationName Micr ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException + FullyQualifiedErrorId : -2144108297,PSSessionOpenFailed But If i run this command on localy on server New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://ex01.domain.com/PowerShell/ -Authentication Kerberos everything is ok. Snapin: Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn - works. 3. Search mailbox When I run: Get-MailboxSearch I get error: Get-MailboxSearch : The requesting account does not have permission to serialize tokens. AD Exchange server computer account is member of: Domain Computers Exchange Install Domain Servers Exchange Servers Exchange Trusted subsystem Managed Availability Servers So exchange computer account doesn't belong to: Domain Admins Schema Admins Enterprise Admins Organization Management I created a new user account: Admin123 and added it to local server Administrators group Discovery Management group Domain Users Server Management but Get-MailboxSerach give the same error. Could somebody help to solve these problems? Tanks in advance Tom
DKIM CnameMissing for alderohotel.it stuck for 6 days - backend cache reset needed
DKIM for custom domain alderohotel.it has been stuck in CnameMissing status for 6 days despite correct CNAME records. Tenant: alderotech (Microsoft 365) CNAME records published on Aruba DNS: - selector1._domainkey.alderohotel.it → selector1-alderohotel-it._domainkey.alderotech.w-v1.dkim.mail.microsoft.com - selector2._domainkey.alderohotel.it → selector2-alderohotel-it._domainkey.alderotech.w-v1.dkim.mail.microsoft.com Verified via PowerShell Resolve-DnsName: records resolve correctly. Get-DkimSigningConfig -Identity alderohotel.it returns Status: CnameMissing. Set-DkimSigningConfig -Enabled $true fails with CNAME validation error. Microsoft support diagnostic tool also shows CnameMissing. Requesting manual backend cache reset for DKIM signing config on alderohotel.it.
550 5.7.705 Tenant Email Block 55+ Hours - Support Unresolved
Our M365 tenant (labaradorpake.onmicrosoft.com) has been blocked from sending outbound email for over 55 hours with error 550 5.7.705 Access denied, tenant has exceeded threshold. Despite multiple support tickets and promises of 24-hour resolution, the block remains active. **Error Details:** - NDR: 550 5.7.705 Access denied, tenant has exceeded threshold - Scope: External outbound email only is blocked; internal tenant-to-tenant email works fine - Microsoft Defender Restricted Entities page shows 0 restricted users — the block is at tenant level, NOT user level - No transport rules exist that could be blocking outbound - No alerts in Exchange Admin Center **Timeline:** - June 19: Support ticket #2606190040005588 created, agent Manisha confirmed remediation complete and promised block would be lifted within 24 hours - June 21 (55+ hours later): Block STILL ACTIVE. Manisha has not responded to follow-ups. - June 21: Created 2nd ticket #2606210040000778, assigned to agent Odunayo — no action taken - June 21: Created 3rd ticket #2606210040000844 with phone callback request — no callback received yet **What we have tried:** 1. Three Microsoft support tickets (all Sev C) 2. Escalation emails to agent, tech lead, team manager (all bounce due to tenant block preventing outbound email) 3. Support Assistant chat bot — cannot escalate to human agents 4. Azure Portal support — No Access for this tenant tier 5. getsupport.microsoft.com — No Access 6. Microsoft Learn Q&A post: https://learn.microsoft.com/en-us/answers/questions/5926147 7. Phone callback requested on 3rd ticket — still waiting **Critical Impact:** The tenant cannot send ANY external email. All outbound messages to external recipients bounce with 550 5.7.705. This is a complete business email outage that has persisted for over 55 hours despite Microsoft support confirming remediation was complete. Has anyone experienced a similar tenant-level block (550 5.7.705) that took this long to resolve? What escalation paths actually work when support agents are unresponsive? Any advice on getting this block lifted urgently would be greatly appreciated. Cross-posted from Microsoft Learn Q&A: https://learn.microsoft.com/en-us/answers/questions/5926147Outlook Desktop users continually prompted for credentials On-Prem Exchange SE
Battling ongoing issues with users being continually prompted for password using Outlook 2024 LTSC with on-prem Exchange 2019 SE. Removed Windows credentials, turned off cache mode, removed shared calendar(s), outlook connection status seems fine. Only (temp) workaround seems to be removing mail profile and recreating it. All other network resources on domain are fine. Any input appreciated. ThanksExchange SE HU6: PDF attachments truncated to 13 KB via Outlook Desktop — OWA unaffected
We've spent days isolating this and ruled out everything we could touch. The corruption survives agent disabling, Bitdefender removal, and BypassFiltering — and the message tracking logs show exactly where it happens. Environment: Exchange Server SE, Build 15.2.2562.41 (HU6 / KB5081755), Windows Server 2025 Problem: PDF attachments sent internally via Outlook Desktop (MAPI) arrive corrupted at ~13 KB (original: ~32 KB, no xref/EOF). All PDF sizes, all internal recipients affected. Started 21 May 2026. Key finding — OWA works, Outlook Desktop doesn't: Sending the identical email via OWA → attachment arrives intact. Outlook Desktop → truncated. Message tracking proof: Both paths deliver the message at full size (~42 KB) via STOREDRIVER DELIVER. Only the Outlook Desktop delivery shows an additional X-SDDS=0.106 step in the STOREDRIVER latency breakdown. That step does not appear in the OWA delivery. The corruption happens inside that MAPI/TNEF store write step — not in transport. Systematically ruled out: All transport agents disabled → still 13 KB Exchange Malware Agent + Set-MalwareFilteringServer -BypassFiltering $true → still 13 KB Bitdefender GravityZone fully uninstalled from server → still 13 KB EEMS mitigations: only PING1 and M2.1.0 applied, neither affects MAPI delivery Temporal correlation: Three Windows updates installed 21.05.2026: KB5087051 (.NET Framework 4.8.1), KB5087539 (Windows Server 2025 CU), KB5089717 (Servicing Stack). Exchange SE HU6 (KB5081755) was installed around the same period. Workaround: Sending via OWA works. Not acceptable long-term. Has anyone seen this? Is this a known regression in HU6 or KB5087051?
Recent Blogs
- We wanted to provide a reminder that Exchange 2016 and 2019 ESU program ends in October 2026.Jul 20, 2026
- We have released Security Updates for Exchange Server SE. Exchange Server 2019 and 2016 ESU updates only.Jul 14, 2026
