Recent Discussions
Missing Teams Contacts after Migration
Hello, We are currently migrating mailboxes from exchange 2019 to exchange online. The migration works absolute flawless. Now we have some employees complaining about missing teams contacts that were previously created in Teams only. The MS support told me that this is a teams limitation and the local contacts are gone. I know about unified contacts, thats contacts are synced now between outlook and teams and newly created contacts are stored in exchange online mailbox. But whatabout the old contacts ?? cant believe that theres no workaround to keep this contacts. Do you know something about this ? Rene
Which ExchangeServerApp is the right one? How to tell?
From running HCW multiple times w/ various exceptions, we have a number of separate ExchangeServerApp instances in Entra. How can I definitively tell which one (or more) is the correct instance? I can't find any of the UUIDs in the Entra entries anywhere in the Exchange Server configuration. I can't run the ConfigureHybridExchangeApplication script because (from the error it gives) it doesn't handle the multiple app identifiers. I submitted feedback but haven't heard back from the CSS-Exchange people. Any guidance appreciated.
Licensing question: Exchange Server SE for CSP M365 E3/E5 customers without Extended Use Rights
Does anyone have any information on licensing the new Exchange Server SE for customers who have M365/O365 E3/E5 purchased via CSP but do not have Extended Use Rights (i.e., no EA/EAS -> no on-prem Office server licenses included)? Specifically: Is it enough to license Exchange Server SE per node only, or Do customers also need to purchase Exchange Server CALs per user (even if they already have M365 E3/E5)? I’ve spoken with multiple licensing distributors and a Microsoft partner contact, but I still haven’t been able to get a definitive answer. According to a comment from Jeremy Carlson and Microsoft’s licensing documentation, certain licenses appear to include "CAL-equivalency rights". Can anyone here confirm whether these CAL-equivalency rights cover access to Exchange Server SE in the CSP E3/E5 (no Extended Use Rights) scenario? licensing reference: https://www.microsoft.com/licensing/terms/product/CALandMLEquivalencyLicenses/MCA#clause-2165-h3-1
How to consistently differentiate Microsoft service notification emails from normal user emails?
I receive a large number of notification mails from Microsoft services (SharePoint, Teams, etc.) and they clutter my mailbox. I’ve tried: Inbox rules filtering by sender (e.g., email address removed for privacy reasons) → doesn’t work since Microsoft uses many changing domains. Filtering by Microsoft IP ranges → some internal org mails also get caught. Filtering by domains from Microsoft endpoint list → works, but the list updates monthly, so not reliable. Question: Is there a consistent way (e.g., via Internet message headers or any other property) to reliably identify Microsoft-generated notification emails vs normal user emails?Our mail domain isn't safe by default for Exchange Online users
Hello all, Our PR Team requested to force automatic download of pictures for internal letters that are sent by the team. We decide to use GP setting "Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists" from Office an administrative template. It works fine for users with on-prem mailboxes because our mail domain is in the Safe Senders by default, but it doesn't work for users with mailboxes in Exchange Online. For EO mailboxes, pictures of internal letters are not downloaded automatically in classic Outlook. They have to add "@<our mail domain" to Safe Senders list to download pictures automatically. Any attempts to add the same domain by using Set-MailboxJunkEmailConfiguration fail because "the domain is the default mail domain"! (And should be treated as safe). Headers show that letters are not "Anonymous" but internal. It looks like a bug, or we missed something in our Hybrid configuration. Any ideas? King regards, Dmitry Horushin
Microsoft some server IP not in SPF List?
We Have add DNS record v=spf1 include:spf.protection.outlook.com -all , but find to SPF is failed spf:demo.com:2603:1096:301:11b::15 how can we solve this problem , because we need increase the security Level , would like quarantine / set to junk mailbox for SPF Fail mail Thank
Configure Dedicated Exchange Server Application
Currently our product ranning exchange 2019 CU15 with Exchange hybrid, so what else need configure other task for configuration of the dedicated application for Exchange Server. HCW8126 - Admin consent was not granted during the configuration of the dedicated application for Exchange Server. The application will be created but will not function until consent is provided. Please re-run the Hybrid Configuration Wizard (HCW) or grant consent via the Entra ID portal before using the application.
Hotfix update for 2016 CU23 HU18: (KB5066370) breaks OWA and leaves all services disabled
Has anyone else applied the latest hotfix? First of all it tries to validate open files instead of just killing these processes as part of the update, then after rebooting all the services are left in a disabled state. Then I discover it has broken IIS and OWA doesnt work. We have had client issues all day in the office. It looks like another update has been pushed out without sufficient testing. Any help would be grateful at this point, I am looking to take 2 out of 4 servers offline.
Update Federation Trust Certificate
Almost five years ago, I had set this up. I realized the cert is about to expire. I only have on test account on prem, everything else is in the cloud. Oauth is set up and we do have token based auth. I followed the steps to generate a new self signed cert, everything looks good even the text file in DNS. The issue is, when I run set-federationtrust - identity "Microsoft Federation Gateway -publishfederationcertificate, I get the following error. [FailureCategory=Cmdlet-Live DomainServicesException] 2B0D1031,Microsoft.Exchange.Management.SystemConfigurationTasks.SetFederationTrust + PSComputerName I have search and and tried several things for TLS 1.2 Enforcing TLS 1.2 on Windows 2019 via the reg Windows Registry Editor Version 5.00 enforce SchUseStrongCrypto Force Powershell to run tls1.2 I had to remove some of the verbage - i think the forum does not like it. Does anyone have any ideas Thanks PaulI need help with migration
Hello I need to migrate our account to a wider business due to a merger. In general, I need to change the domain name while keeping my email history without losing any data. On top, I need to ensure after that after the change the extensions of our emails from (i.e @ abc.com to @ abd.com) to have access to the emails which are still being sent to @ abc.com, for example being automatically forwarded to the new email addresses.Domain not routing mail or logins correctly after tenant transfer
Hello Please i need your help on this issue. Domain not routing mail or logins correctly after tenant transfer. I recently removed the domain sustainable.XXXX from an old Microsoft 365 tenant (based in Chile) and added it as the default domain in my new tenant (based in Spain). The domain is showing as Authoritative and in a healthy state in the Microsoft 365 Admin Center. DNS records (MX, SPF, CNAME autodiscover) are all configured correctly and propagate globally (checked with multiple DNS tools). However, I am still experiencing two critical issues: Authentication / Login Redirect. When I try to log in with rphilippe@ sustainable.XXXX in Office apps (desktop and mobile), the login is automatically redirected to the old Chile tenant (…onmicrosoft.com), which no longer has my domain or licenses. This prevents me from signing into Office apps with my licensed email address in the new Spain tenant. Mail Flow – No Inbound Delivery I can send outbound emails from rphilippe@ sustainable.XXX without problems. But inbound emails from Gmail/Yahoo do not appear in Message Trace in Exchange Online. This indicates that messages are not reaching my new tenant at all, despite correct MX records. Steps already taken: Removed domain completely from old tenant. Verified domain ownership in new tenant. Configured all required DNS records at my registrar (Wix). Waited more than X hours since DNS propagation completed (global MX records confirmed). Tested with Message Trace and Quarantine: no trace of inbound messages. Request: Please verify and force a refresh of Home Realm Discovery (HRD) and Exchange Online domain routing for sustainable.XXX, to ensure: Authentication requests for @ sustainable.XXXX point to the correct (Spain) tenant. Inbound email is routed correctly to the new tenant. This appears to be an internal Microsoft propagation/cache issue, not a DNS or local client issue.Exchange SE and Domain / Forest Functional Level 2025 Support
Does anyone have any general idea on when they may test support for Domain / Forest Functional Level 2025? We're still rocking hybrid with Exchange SE and ExO and as such we're waiting on the supportability matrix (https://learn.microsoft.com/en-us/exchange/plan-and-deploy/supportability-matrix#supported-active-directory-environments) to get updated so we can raise the DFL/FFL. Currently Exchange SE supports 2025 AD servers so they've verified the schema update from 88 to 91 is good to go but our Exchange team doesn't want us to raise the functional level until this matrix shows that it's supported for our current Exchange version. Thanks for any insight. Supported Active Directory environments The following table lists the supported Active Directory environments for Exchange Server. Version Active Directory servers Forest Functional Levels Exchange Server SE Windows Server 2025 Windows Server 2022 Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 Windows Server 2016 Windows SApplying On-Prem EAP with New-Remote Mailbox
BACKGROUND: my org is in a hybrid AD/Exchange environment, and will remain so for some time. All mailboxes, other than a very small number with on-prem dependencies, were migrated to M365 a few years ago; we will continue to have 1-2 Exchange Servers on-premises for both management and some legacy on-prem processes. All user accounts are created on-premises, and synchronized to M365 through Entra Connect Sync. Our on-prem EAP has the exact address syntaxes that we need [applies to "Users with Exchange mailboxes" + "Resource mailboxes" + "Mail-enabled groups"]. I haven't found a clear answer to the question: with an Exchange 2019 (and soon SE) server on-premises - with users initially created on-premises - is there a way to provision new EXO mailboxes [using the 'new-remotemailbox' cmdlet], such that the on-prem EAP applies during creation? I've been working with these two references, but so far haven't found a way to make the "new-remotemailbox..." cmdlet work to (a) create a new account on-premises and (b) ultimately have an EXO mailbox provisioned with the on-prem EAP addresses in place: On provisioning mailboxes in Exchange Online when in Hybrid | Microsoft Community Hub https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-remotemailbox?view=exchange-ps Any thoughts or suggestions would be welcomed! (OR - perhaps it just can't be done?)Use PowerShell to Send Messages from Shared Mailboxes, Groups, and Distribution Lists
Everyone probably knows how to use Exchange's Send As and Send on Behalf of permissions to send email from user mailboxes. Here we venture into the same task, but for Microsoft 365 Groups, shared mailboxes, distribution lists, and mail-enabled security groups. Once your permissions are aligned, everything is pretty simple. https://practical365.com/sendas-send-on-behalf-of-mail-objects/
How to perform Windows Update for Exchange 2016 DAG Cluster
Hello, I need to install windows server security update on Exchange 2016 DAG which require reboot the server. I will install the updates on the first server Tuesday, and the seconde server on Wednesday. I'm wondering if installing patches on separated days may impact Exchange services, also i need to know the steps to follow before restart each server after installing the patch.Exchange EWS API Error
After migrating from 2016 to 2019 and SE, I was trying to move my script to the new server but came up with many issues. I was using this yesterday and it was working and today it's not. Seems random and no idea why it's happening that Exchange2016 disappears from the selection. $Service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService( [Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2016 ) The property 'Exchange2016' cannot be found on this object. Verify that the property exists. At line:1 char:1 + $Service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeSer ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException + FullyQualifiedErrorId : PropertyNotFoundStrict If I run the following, Exchange2016 is no longer in the list (it was when I tried yesterday). This seems random, [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Set-StrictMode -Version Latest Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn Add-Type -Path 'C:\Setup\ExchangeEWS\Microsoft.Exchange.WebServices.dll' # Get the type information for the ExchangeVersion enumeration $type = [Microsoft.Exchange.WebServices.Data.ExchangeVersion] # Get all declared fields $fields = $type.GetFields('DeclaredOnly, Public, Static') # Iterate over each field and display its name and value foreach ($field in $fields) { Write-Output "$($field.Name) = $($field.GetValue($null))" } Output: Exchange2007_SP1 = Exchange2007_SP1 Exchange2010 = Exchange2010 Exchange2010_SP1 = Exchange2010_SP1 Exchange2010_SP2 = Exchange2010_SP2 Exchange2013 = Exchange2013 Exchange2013_SP1 = Exchange2013_SP1 And if I run in Powershell ISE, I see more error (same script in regular powershell works). Exception calling "FindItems" with "2" argument(s): "The request failed. The underlying connection was closed: An unexpected error occurred on a send." At line:87 char:5 + $Items = $Service.FindItems( 'Inbox', ( New-Object Microsoft.Exch ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : ServiceRequestException
Recent Blogs
- A reminder that on September 16 2025, we will enforce the first temporary block of shared security principal use for our hybrid customers.Sep 12, 2025
