%3CLINGO-SUB%20id%3D%22lingo-sub-1484009%22%20slang%3D%22en-US%22%3EConfiguring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1484009%22%20slang%3D%22en-US%22%3E%3CP%3EOver%20the%20last%20several%20months%2C%20we%20have%20seen%20many%20customers%20adopting%20Microsoft%20Teams%2C%20even%20if%20their%20mailboxes%20are%20still%20hosted%20in%20an%20on-premises%20environment.%20One%20of%20the%20common%20issues%20in%20this%20scenario%20is%20not%20being%20able%20to%20see%20the%20Calendar%20tab%20in%20the%20Microsoft%20Teams%20client.%3C%2FP%3E%0A%3CP%3EWould%20you%20like%20to%20know%20how%20to%20troubleshoot%20this%3F%20Read%20on!%3C%2FP%3E%0A%3CP%3EFor%20cloud%20users%2C%20the%20Calendar%20section%20in%20Teams%20is%20connected%20to%20their%20Exchange%20Online%20(EXO)%20calendar.%20In%20other%20words%2C%20when%20you%20schedule%20a%20meeting%20in%20Outlook%2C%20it'll%20show%20up%20in%20Teams%20(and%20vice%20versa).%20For%20a%20great%20overview%20of%20this%20functionality%2C%20see%20%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2Fschedule-a-meeting-in-teams-943507a9-8583-4c58-b5d2-8ec8265e04e5%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ESchedule%20a%20meeting%20in%20Teams%3C%2FA%3E%3C%2FSPAN%3E.%3C%2FP%3E%0A%3CP%3ETo%20make%20calendar%20access%20work%20for%20your%20on-prem%20mailboxes%2C%20Teams%20needs%20access%20to%20your%20Exchange%20on-prem%20organization%20for%20both%20Autodiscover%20and%20EWS.%20There%20are%20several%20things%20to%20remember%20here.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EAutodiscover%20and%20EWS%20URLs%20should%20be%20available%20from%20the%20Internet.%20Pre-Auth%20is%20not%20supported.%20If%20you%20use%20some%20sort%20of%20publishing%20system%2C%20you%20will%20need%20to%20configure%20pass-through.%20You%20can%20verify%20that%20external%20URLs%20on-prem%20are%20accessible%2C%20trying%20to%20open%20them%20from%20internet%20directly%20in%20web%20browser.%20Test%20with%20%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fmail.contoso.com%2FEWS%2FExchange.asmx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fmail.contoso.com%2FEWS%2FExchange.asmx%3C%2FA%3E%3C%2FSPAN%3E%20and%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fautodiscover.contoso.com%2FAutodiscover%2FAutodiscover.xml%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%26nbsp%3Bhttps%3A%2F%2Fautodiscover.contoso.com%2FAutodiscover%2FAutodiscover.xml%3C%2FA%3E%3C%2FSPAN%3E%20.You%20can%20also%20use%20%3CSPAN%3E%3CA%20href%3D%22http%3A%2F%2Faka.ms%2Fexrca%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Faka.ms%2Fexrca%3C%2FA%3E%3C%2FSPAN%3E%20to%20test%20connectivity%26nbsp%3B%20for%20EWS%20and%20AutoDiscover.%20But%20note%2C%20that%20those%20tests%20don%E2%80%99t%20use%20OAUTH%20(as%20of%20this%20writing).%20So%2C%20sometimes%20you%20might%20see%20that%20those%20tests%20pass%20successfully%2C%20but%26nbsp%3B%20free%2Fbusy%20for%20on-prem%20users%20is%20not%20visible%20from%20your%20tenant%20(see%20further%20below%20for%20more%20troubleshooting%20tips).%3C%2FLI%3E%0A%3CLI%3EOAUTH%20authentication%20should%20be%20configured%20and%20working%20between%20you%20O365%20tenant%20and%20Exchange%20on-prem.%20To%20make%20this%20work%2C%20we%20highly%20recommended%20to%20run%20Hybrid%20Configuration%20Wizard%20(HCW)%20to%20configure%20full%20hybrid%20mode.%20For%20on-premises%20deployments%20(newer%20than%20Exchange%202010)%20HCW%20automatically%20configures%20OAUTH%20between%20on-premises%20and%20EXO.%20Please%20make%20sure%20to%20run%20the%20latest%20CUs%20on-premises%20as%20per%20our%20Hybrid%20requirements.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EThere%20are%20some%20other%20prerequisites%3A%20users%20with%20on-premises%20mailboxes%20must%20be%20synchronized%20to%20Azure%20Active%20Directory.%20On-premises%20mailboxes%20should%20be%20on%20Exchange%202016%20CU3%20or%20higher%2C%20as%20per%20%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoftteams%2Fexchange-teams-interact%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ethis%20article%3C%2FA%3E%3C%2FSPAN%3E.%3C%2FP%3E%0A%3CP%3EIf%20everything%20is%20working%20fine%2C%20you%20should%20see%20Calendar%20tab%20in%20your%20Teams%20client.%20When%20you%20switch%20to%20your%20Calendar%20tab%2C%20it%20should%20be%20%E2%80%9Cup%20to%20date%E2%80%9D%20(you%20may%20need%20to%20re-login%20to%20the%20client)%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22Teamscal01.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200553iAD939DABA271A5A9%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Teamscal01.jpg%22%20alt%3D%22Teamscal01.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%20id%3D%22toc-hId--1323071566%22%3E%3CFONT%20size%3D%226%22%3E%3CSPAN%3EUh-oh%3B%20it%E2%80%99s%20not%20working.%20Now%20what%3F%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FH2%3E%0A%3CP%3EIf%20you%20used%20HCW%2C%20verify%20Service%20Principal%20Name%20(SPN)%20endpoints%20configured%20for%20Azure%20AD.%26nbsp%3B%20There%20should%20be%20at%20least%202%20endpoints%20for%20EWS%20and%20Autodiscover.%20If%20you%20don%E2%80%99t%20see%20them%2C%20you%20can%20%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fenterprise%2Fpowershell%2Fconnect-to-office-365-powershell%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Econnect%20to%20AzureAD%3C%2FA%3E%3C%2FSPAN%3E%20%26nbsp%3Bvia%20PowerShell%20and%20check%2Fconfigure%20them%20manually%20(please%20see%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fexchange%2Fconfigure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ethis%20article%3C%2FA%3E%20for%20details).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E%24ServiceName%20%3D%20%2200000002-0000-0ff1-ce00-000000000000%22%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%24x%20%3D%20Get-MsolServicePrincipal%20-AppPrincipalId%20%24ServiceName%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%24x.ServicePrincipalnames.Add(%22%3CA%20href%3D%22https%3A%2F%2Fmail.contoso.com%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fmail.contoso.com%2F%3C%2FA%3E%22)%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%24x.ServicePrincipalnames.Add(%22%3CA%20href%3D%22https%3A%2F%2Fautodiscover.contoso.com%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fautodiscover.contoso.com%2F%3C%2FA%3E%22)%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3ESet-MSOLServicePrincipal%20-AppPrincipalId%20%24ServiceName%20-ServicePrincipalNames%20%24x.ServicePrincipalNames%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%20id%3D%22toc-hId--632510092%22%3E%3CFONT%20size%3D%225%22%3EURL%20to%20confirm%20Autodiscover%20is%20available%3C%2FFONT%3E%3C%2FH3%3E%0A%3CP%3ETo%20test%20if%20Autodiscover%20is%20available%2C%20you%20can%20use%20the%20following.%20For%20an%20on-premises%20mailbox%2C%20if%20hybrid%20is%20configured%20correctly%2C%20%3CEM%3EO365%20should%20route%20back%20to%20on-premises%3C%2FEM%3E%3A%3C%2FP%3E%0A%3CP%20data-unlink%3D%22true%22%3Ehttps%3A%2F%2Foutlook.office365.com%2Fautodiscover%2Fautodiscover.json%3FEmail%3D%3CFONT%20color%3D%22%23FF0000%22%3E%3CFONT%20color%3D%22%23FF0000%22%3Eadmin%40contoso.com%3C%2FFONT%3E%3C%2FFONT%3E%26amp%3BProtocol%3DEWS%26amp%3BRedirectCount%3D5%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAfter%20redirect%20is%20completed%2C%20you%20should%20see%20the%20following%20on-premises%20EWS%20URL%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22Teamscal02.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200554iCD9B16A82780177D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Teamscal02.jpg%22%20alt%3D%22Teamscal02.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3ECollecting%20logs%20from%20Microsoft%20Teams%20client%3C%2FFONT%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ETo%20make%20troubleshooting%20easier%2C%20you%20need%20to%20sign%20out%20from%20Microsoft%20Teams%20client%20and%20then%20sign%20back%20in.%20It%20will%20force%20calendar%20load%20and%20it%20will%20be%20easier%20to%20find%20error%20in%20log%20or%20successful%20location%20of%20user%E2%80%99s%20mailbox.%3C%2FLI%3E%0A%3CLI%3EWait%20until%20Calendar%20app%20appears%20(if%20everything%20successful)%20or%20not%20(if%20something%20went%20wrong)%3C%2FLI%3E%0A%3CLI%3EGet%20the%20logs%20from%20the%20client%3A%20press%20(CTRL%2BALT%2BSHFT%2B1)%20for%20Windows%20and%20(Command%2BOption%2BSHFT%2B1)%20for%20Mac%20from%20within%20the%20client%20to%20download%20logs%3C%2FLI%3E%0A%3CLI%3ESearch%20for%20Calendar%20App.%20If%20the%20mailbox%20is%20discoverable%2C%20logs%20will%20show%20something%20like%20this%3A%20%3CEM%3EUserAppsStore%3A%20Added%20calendar%20app%20with%20isFirstParty%20as%20true.%20isMailboxDiscoverable%3A%20true%2C%20isFreemiumTenant%3A%20false%2C%20enableFreemiumCalendar%3A%20true%3C%2FEM%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3EChecking%20EWSAllow%20Agent%20Strings%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EEWS%20access%20can%20be%20blocked%20by%20EWSAllow%20Agent%20settings%20in%20your%20Exchange%20on-prem%20organization.%20These%20can%20be%20configured%20either%20at%20the%20mailbox%20level%20or%20Organization%20level.%20This%20is%20not%20very%20common%2C%20but%20we%20have%20seen%20some%20organizations%20use%20custom%20EWS%20settings%20on-premises.%3C%2FP%3E%0A%3CP%3ECheck%20if%20any%20agents%20are%20blocked%20on%20the%20Organizational%20level%20(the%20following%20shows%20none%20are%20%E2%80%93%20default%20setting)%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22Teamscal03.jpg%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200557iB4240DF1E49D2DF3%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22Teamscal03.jpg%22%20alt%3D%22Teamscal03.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EAlso%20check%20the%20setting%20for%20the%20mailbox%20you%20are%20troubleshooting%20Calendar%20access%20for%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22Teamscal04.jpg%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200558i28FA1DAAE69C43B4%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22Teamscal04.jpg%22%20alt%3D%22Teamscal04.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThe%20following%20agents%20should%20%3CEM%3ENOT%3C%2FEM%3E%20be%20blocked%20as%20they%20are%20used%20to%20access%20on-prem%20servers%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EMicrosoftNinja%2F1.0%20Teams%2F1.0%20(ExchangeServicesClient%2F0.0.0.0)%20SkypeSpaces%2F1.0a%24*%2B%3C%2FLI%3E%0A%3CLI%3ESchedulingService%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CEM%3ESchedulingService%3C%2FEM%3E%20is%20used%20by%20the%20Teams%20middle%20tier%20when%20a%20delegate%20wants%20to%20plan%20a%20Teams%20Meeting%20for%20the%20manager%20using%20the%20OWA%20or%20Outlook%20Teams%20Plugin.%20IIS%20and%20protocol%20logs%20can%20be%20helpful%20to%20confirm%20if%20things%20are%20being%20blocked.%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3EAdditional%20troubleshooting%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EIf%20all%20of%20the%20above%20checks%20out%2C%20troubleshooting%20interoperability%20between%20your%20cloud%20tenant%20and%20on-premises%20organization%20is%20the%20next%20thing%20to%20do.%20Here%20are%20several%20guides%20that%20will%20help%20with%20this%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F10092%2Ftroubleshooting-free-busy-issues-in-exchange-hybrid-environment%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EHybrid%20environment%20free%2Fbusy%20troubleshooter%3C%2FA%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F2555008%2Fhow-to-troubleshoot-free-busy-issues-in-a-hybrid-deployment-of-on-prem%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EHow%20to%20troubleshoot%20free%2Fbusy%20issues%20in%20a%20hybrid%20deployment%20of%20on-premises%20Exchange%20Server%20and%20Exchange%20Online%20in%20Office%20365%3C%2FA%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fexchange-team-blog%2Fdemystifying-hybrid-free-busy-finding-errors-and-troubleshooting%2Fba-p%2F607727%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3EDemystifying%20Hybrid%20Free%2FBusy%3A%20Finding%20errors%20and%20troubleshooting%3C%2FA%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3EYou%20can%20also%20do%20the%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-Free%2FBusy%20connectivity%20test%20using%20EXRCA%3C%2FSPAN%3E%20(you%20should%20have%20at%20least%20one%20mailbox%20migrated%20to%20cloud%20to%20test%20this)%3C%2FLI%3E%0A%3CLI%3EFor%20troubleshooting%20purposes%2C%20you%20can%20use%20the%20article%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-Configure%20OAuth%20authentication%20between%20Exchange%20and%20Exchange%20Online%20organizations%3C%2FSPAN%3E%2C%20this%20article%20contains%20steps%20to%20verify%20SPNs%20in%20Azure%20AD%20and%20explains%20how%20to%20verify%20OAUTH%20connectivity%20with%20Test-OAuthConnectivity%20cmdlet%20from%20on-prem%20and%20O365.%3C%2FLI%3E%0A%3CLI%3EIn%20Exchange%202016%2C%20OATH%20authentication%20is%20enabled%20for%20EWS%20virtual%20directory%20by%20default.%20%26nbsp%3BHowever%2C%20you%20can%20verify%20this%20setting%20by%20using%20the%20command%20below%3A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22Teamscal05.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200559i486DCD0A11151394%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Teamscal05.jpg%22%20alt%3D%22Teamscal05.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22note%22%3E%3CSTRONG%3ENote%3A%3C%2FSTRONG%3E%20if%20you%20migrated%20mailbox%20from%20on-prem%20to%20EXO%2C%20it%E2%80%99s%20easy%20to%20test%20free%5Cbusy%20availability%20using%20Outlook.%20The%20above%20article%20on%20manual%20OATH%20configuration%20can%20be%20also%20useful%20for%20checking%20if%20things%20are%20configured%20properly%20(but%20really%2C%20you%20should%20always%20use%20HCW!)%3C%2FP%3E%0A%3CP%3EIf%20you%20are%20working%20in%20Teams%20calendar%20directly%20and%20you%20try%20to%20invite%20other%20on-prem%20users%20to%20a%20Teams%20meeting%2C%20your%20users%2Fidentities%20need%20to%20be%20synced%20with%20Azure%20AD%20Connect%20to%20be%20visible%20in%20Teams.%20While%20you%20can%20type%20the%20full%20email%20address%20from%20an%20on-prem%20user%20to%20invite%20them%2C%20if%20this%20mail%20domain%20is%20an%20accepted%20domain%20in%20O365%20and%20there%20is%20no%20recipient%20in%20O365%2C%20mail%20delivery%20will%20fail%20with%20unknown%20recipient%20as%20the%20lookup%20will%20be%20done%20in%20O365%20Global%20Address%20Book.%20Mailbox%20itself%20doesn%E2%80%99t%20need%20to%20be%20moved%20to%20EXO%2C%20but%20the%20identity%20should%20be%20synced.%3C%2FP%3E%0A%3CP%3EHope%20this%20helps%20in%20troubleshooting%20your%20Teams%20integration%20with%20on-premises%20mailboxes!%3C%2FP%3E%0A%3CP%3EI%20wanted%20to%20thank%20Nino%20Bilic%20and%20Mirela%20Buruiana%20for%20their%20review%20of%20this%20post.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22author%22%3EViktoria%20Gindosova%3C%2FSPAN%3E%20and%20%3CSPAN%20class%3D%22author%22%3EDmitry%20Chernikov%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1484009%22%20slang%3D%22en-US%22%3E%3CP%3EOver%20the%20last%20several%20months%2C%20we%20have%20seen%20many%20customers%20adopting%20Microsoft%20Teams%2C%20even%20if%20their%20mailboxes%20are%20still%20hosted%20in%20an%20on-premises%20environment.%20One%20of%20the%20common%20issues%20in%20this%20scenario%20is%20not%20being%20able%20to%20see%20the%20Calendar%20tab%20in%20the%20Microsoft%20Teams%20client.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1484009%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECalendaring%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOn%20Premises%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1484346%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1484346%22%20slang%3D%22en-US%22%3E%3CP%3Eone%20additional%20thing%2C%20if%20you%20are%20using%20a%20reverse%20proxy%20such%20as%20a%20KEMP%20load%20balancer%20then%20you%20have%20to%20ensure%20that%20auth%20to%20autodiscover%20is%20delegated%20to%20the%20exchange%20server%2C%20otherwise%20the%20OAuth%20will%20not%20work.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1484530%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1484530%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20is%20one%20more%2C%20which%20can%20block%20Teams%20and%20Exchange%20ONPrem%20calendar%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EYou%20have%20many%20Exchange%20Domains%20OnPrem%3C%2FLI%3E%0A%3CLI%3EYou%20use%20%22autodiscover%20redirect%22%20to%20handle%20that%20(menas%2C%20the%20autodiscover.example.com%20does%20resolve%20to%20a%20HTTP-only%20(no%20certificate%2C%20no%20port%20443)-Server%20which%20issues%20a%20%22302%20Found%22%20with%20the%20target%20url%20als%20payload.%3C%2FLI%3E%0A%3CLI%3ETeams%20Online%20does%20not%20use%20%22AutodiscoverV1%22.%20it%20uses%20AutodiscoverV2%20against%20the%20OnPremises%20Server%20but%20does%20not%20handle%20a%20%22302%20redirect%22%20propertly.%20%3CBR%20%2F%3ESo%20you%20have%20to%20publish%20AutodiscoverV2%20with%20a%20certificate%20for%20every%20domain%20(Think%20about%20traeffik%20with%20let's%20encrypt%20if%20you%20cannot%20add%20all%20names%20into%20an%20SAN-Certificate%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3ESome%20other%20thinks%20to%20check%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECheck%20the%20teams%20Mode.%20It%20should%20be%20Island%2C%20TeamsOnly%20or%26nbsp%3BSfbwithTeamsCollabandMeeting%20to%20see%20an%20calendar%20tab%3C%2FLI%3E%0A%3CLI%3EAlso%20Admins%20can%20use%20AppPolicies%20to%20remove%20the%20calendar%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3EAnd%20make%20sure%2C%20that%20the%20%22Exchange%20hybrid%22-Checkbox%20is%20enabled%20in%20ADSync.%20Otherwise%20EXO%20only%20knows%20the%20Mail%20address%20but%20has%20no%20information%2C%20that%20there%20is%20an%20OnPremises%20Mailbox%20available.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EAll%20four%20are%20common%20issues%20at%20my%20helpdesk.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1486632%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1486632%22%20slang%3D%22en-US%22%3E%3CP%3E%40Viktoria%20and%20%40Dima%2C%20thanks%20a%20ton%20for%20the%20post.%26nbsp%3BThis%20is%20priceless.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1487682%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1487682%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20great.%20Only%20for%20hybrid%20or%20Exchange%20on-prem%20customers%2C%20what%20about%20organisations%20that%20use%20HEX%20(hosted%20Exchange)%20mailboxes%3F%20Yup%20there%20are%20still%20thousands%20of%20HEX%20mailboxes.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGranted%2C%20they%20should%20be%20planning%20to%20migrate%20to%20EXO%20but%20for%20now%2C%20they%20don't%20have%20a%20Teams%20calendar%20tab.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1488202%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1488202%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F40236%22%20target%3D%22_blank%22%3E%40David%20Bargna%3C%2FA%3E%20Hi!%20Do%20you%20mean%2C%20you%20have%20pre-auth%20configured%20on%20your%20KEMP%20load%20balancer%20and%20you%20delegate%20credentials%20(in%20Kerberos%2C%20NTLM...%20%3F).%20Formally%2C%20pre-auth%20is%20not%20supported%20for%20Autodiscover%20and%20EWS.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1488276%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1488276%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Microsoft%20lia-component-message-view-widget-author-username%22%3E%3CSPAN%20class%3D%22%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F632347%22%20target%3D%22_self%22%3E%40ViktGin%3C%2FA%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Microsoft%20lia-component-message-view-widget-author-username%22%3E%3CSPAN%20class%3D%22%22%3E%26nbsp%3BHi%2C%20in%20this%20instance%20for%20autodiscover%20we%20have%20no%20pre-auth%2C%20we%20delegate%20authentication%20directly%20to%20the%20exchange%20server.%20Basically%20drill%20a%20hole%20in%20the%20firewall%20direct%20to%20exchange.%20For%20other%20services%20mapi%2C%20owa%2C%20ews%20etc%20we%20have%20some%20level%20of%20pre-auth%20happening%20on%20the%20kemp%20servers.%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1488600%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1488600%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EHi%26nbsp%3B%40%3C%2FSPAN%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-MVP%20lia-component-message-view-widget-author-username%22%3E%3CA%20id%3D%22link_17%22%20class%3D%22lia-link-navigation%20lia-page-link%20lia-user-name-link%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F29533%22%20target%3D%22_self%22%3E%3CSPAN%20class%3D%22%22%3EFrank%20Carius%26nbsp%3B%3C%2FSPAN%3E%3C%2FA%3E%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3BWith%20Auto%20Discover%20V2%2C%20which%20was%20introduced%20with%20Exchange%202016%20CU3%2C%20the%20autodiscover%20request%20is%20a%20non-authenticated%20request%20using%20JSON.%20This%20is%20why%20we%20support%20V2%20from%20middle%20tier%20and%20have%20best%20effort%20support%20for%20now%20with%20V1.%20This%20is%20a%20little%20bit%20confusing%20and%20in%2099%25%20cases%20AutoD%20v2%20is%20working.%20So%20we%20decided%20not%26nbsp%3B%20to%20create%20confusion%20and%20removed%20reference%20to%20a%20version%20from%20article.%20Thanks%20a%20lot%20for%20sharing%20your%20opinion%2C%20it%20make%20sense%20for%20customers%20with%20configuration%20like%20yours.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1488618%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1488618%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20day%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F34642%22%20target%3D%22_blank%22%3E%40Matthew%20Levy%3C%2FA%3E%20!%20Initially%20we%20planned%20the%20cover%20most%20important%20steps%20you%20need%20to%20take%20into%20account%20while%20configure%20Teams%20Calendar%20with%20Exchange%20on-prem.%20We%20don't%20rule%20out%20creation%20of%20additional%20article%20if%20we%20have%20enough%20of%20demand%20and%20content%20%3A)%3C%2Fimg%3E%20Can%20I%20ask%20you%2C%20what%20exactly%20do%20you%20mean%20by%20%22hosted%22%20Exchange%20environment%20in%20your%20situation%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1488629%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1488629%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%2C%26nbsp%3B%20%40%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Contributor%20lia-component-message-view-widget-author-username%22%3E%3CSPAN%20class%3D%22%22%3E%3CA%20id%3D%22link_25%22%20class%3D%22lia-link-navigation%20lia-page-link%20lia-user-name-link%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F76441%22%20target%3D%22_self%22%3EDavid%20Bargna%3C%2FA%3E%2C%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3Enow%20it's%20clear%20enough!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1493120%22%20slang%3D%22fr-FR%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1493120%22%20slang%3D%22fr-FR%22%3E%3CP%3EHello%2C%20very%20nice%20article.%3C%2FP%3E%3CP%3EI%20would%20like%20to%20add%20one%20observation%3A%3C%2FP%3E%3CP%3Eit%20seems%20that%20autod%20v2%20is%20not%20AD%20site%20aware.%20So%20it%20means%20that%20Ews%20externalurl%20need%20to%20be%20setup%20also%20on%20non-internet%20facing%20mbx.%20For%20example%20in%20multiregion%20data%20centers%20EU%2C%20NA%20and%20APAC%20and%20only%20EU%20are%20facing%20internet%2C%20ews%20externalurl%20also%20need%20to%20be%20setup%20on%20NA%20and%20APAC%20mbx%20also%20otherwise%20the%20autodiscover.json%20file%20retrieved%20may%20contains%20internal%20url%20when%20a%20non-internet%20facing%20mbx%20reply.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELooks%3C%2FP%3E%3CP%3EVinam799%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1493669%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1493669%22%20slang%3D%22en-US%22%3E%3CP%3EWell%20this%20has%20highlighted%20one%20important%20fact%20for%20me.%26nbsp%3B%20The%20on-premises%20mailbox%20must%20be%20hosted%20on%20Exchange%202016%20in%20order%20for%20this%20to%20work.%26nbsp%3B%20Very%20handy%20to%20know.%20Unfortunate%20for%20those%20customers%20relying%20on%20the%20free%20hybrid%20licence%20key%20which%20stiplulates%20that%20no%20mailboxes%20must%20be%20hosted%20on%20that%20server.%26nbsp%3B%20This%20would%20represent%20the%20vast%20majority%20of%20my%20customers.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20posting%20this.%26nbsp%3B%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Fhtml%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1495410%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1495410%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20day%2C%26nbsp%3B%40%3CSPAN%3EVinam799%2C%20Yes.%20AutoD%20V2%20is%20not%20site%20aware.%20That%20would%20be%20great%20to%20have%20separate%20article%20on%20AutoD%20v2%26nbsp%3B%20in%20the%20future%2C%20as%20this%20topic%20is%20not%20covered%20very%20well.%20unfortunately%2C%20we%20cannot%20do%20this%20here.%20Thanks%20for%20addition!%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1496749%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Teams%20calendar%20access%20for%20Exchange%20on-premises%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1496749%22%20slang%3D%22en-US%22%3E%3CP%3Egreat%20post.%3C%2FP%3E%3CP%3Ei%20have%20one%20question%20can%20i%20limit%20the%20connection%20to%20Exchange%20on-primes%20autodicover%20and%20EWS%20only%20from%20Microsoft%20Exchange%20online%20IP%20address%20%2C%20or%20it%20must%20be%20published%20to%20all%20internet%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E

Over the last several months, we have seen many customers adopting Microsoft Teams, even if their mailboxes are still hosted in an on-premises environment. One of the common issues in this scenario is not being able to see the Calendar tab in the Microsoft Teams client.

Would you like to know how to troubleshoot this? Read on!

For cloud users, the Calendar section in Teams is connected to their Exchange Online (EXO) calendar. In other words, when you schedule a meeting in Outlook, it'll show up in Teams (and vice versa). For a great overview of this functionality, see Schedule a meeting in Teams.

To make calendar access work for your on-prem mailboxes, Teams needs access to your Exchange on-prem organization for both Autodiscover and EWS. There are several things to remember here.

  • Autodiscover and EWS URLs should be available from the Internet. Pre-Auth is not supported. If you use some sort of publishing system, you will need to configure pass-through. You can verify that external URLs on-prem are accessible, trying to open them from internet directly in web browser. Test with https://mail.contoso.com/EWS/Exchange.asmx and https://autodiscover.contoso.com/Autodiscover/Autodiscover.xml .You can also use http://aka.ms/exrca to test connectivity  for EWS and AutoDiscover. But note, that those tests don’t use OAUTH (as of this writing). So, sometimes you might see that those tests pass successfully, but  free/busy for on-prem users is not visible from your tenant (see further below for more troubleshooting tips).
  • OAUTH authentication should be configured and working between you O365 tenant and Exchange on-prem. To make this work, we highly recommended to run Hybrid Configuration Wizard (HCW) to configure full hybrid mode. For on-premises deployments (newer than Exchange 2010) HCW automatically configures OAUTH between on-premises and EXO. Please make sure to run the latest CUs on-premises as per our Hybrid requirements.

There are some other prerequisites: users with on-premises mailboxes must be synchronized to Azure Active Directory. On-premises mailboxes should be on Exchange 2016 CU3 or higher, as per this article.

If everything is working fine, you should see Calendar tab in your Teams client. When you switch to your Calendar tab, it should be “up to date” (you may need to re-login to the client):

Teamscal01.jpg

Uh-oh; it’s not working. Now what?

If you used HCW, verify Service Principal Name (SPN) endpoints configured for Azure AD.  There should be at least 2 endpoints for EWS and Autodiscover. If you don’t see them, you can connect to AzureAD  via PowerShell and check/configure them manually (please see this article for details).

 

$ServiceName = "00000002-0000-0ff1-ce00-000000000000";

$x = Get-MsolServicePrincipal -AppPrincipalId $ServiceName;

$x.ServicePrincipalnames.Add("https://mail.contoso.com/");

$x.ServicePrincipalnames.Add("https://autodiscover.contoso.com/");

Set-MSOLServicePrincipal -AppPrincipalId $ServiceName -ServicePrincipalNames $x.ServicePrincipalNames;

URL to confirm Autodiscover is available

To test if Autodiscover is available, you can use the following. For an on-premises mailbox, if hybrid is configured correctly, O365 should route back to on-premises:

https://outlook.office365.com/autodiscover/autodiscover.json?Email=admin@contoso.com&Protocol=EWS&RedirectCount=5  

After redirect is completed, you should see the following on-premises EWS URL:

Teamscal02.jpg

 

Collecting logs from Microsoft Teams client

  • To make troubleshooting easier, you need to sign out from Microsoft Teams client and then sign back in. It will force calendar load and it will be easier to find error in log or successful location of user’s mailbox.
  • Wait until Calendar app appears (if everything successful) or not (if something went wrong)
  • Get the logs from the client: press (CTRL+ALT+SHFT+1) for Windows and (Command+Option+SHFT+1) for Mac from within the client to download logs
  • Search for Calendar App. If the mailbox is discoverable, logs will show something like this: UserAppsStore: Added calendar app with isFirstParty as true. isMailboxDiscoverable: true, isFreemiumTenant: false, enableFreemiumCalendar: true

Checking EWSAllow Agent Strings

EWS access can be blocked by EWSAllow Agent settings in your Exchange on-prem organization. These can be configured either at the mailbox level or Organization level. This is not very common, but we have seen some organizations use custom EWS settings on-premises.

Check if any agents are blocked on the Organizational level (the following shows none are – default setting):

Teamscal03.jpg

Also check the setting for the mailbox you are troubleshooting Calendar access for:

Teamscal04.jpg

The following agents should NOT be blocked as they are used to access on-prem servers:

  • MicrosoftNinja/1.0 Teams/1.0 (ExchangeServicesClient/0.0.0.0) SkypeSpaces/1.0a$*+
  • SchedulingService

SchedulingService is used by the Teams middle tier when a delegate wants to plan a Teams Meeting for the manager using the OWA or Outlook Teams Plugin. IIS and protocol logs can be helpful to confirm if things are being blocked.

Additional troubleshooting

If all of the above checks out, troubleshooting interoperability between your cloud tenant and on-premises organization is the next thing to do. Here are several guides that will help with this:

Teamscal05.jpg

Note: if you migrated mailbox from on-prem to EXO, it’s easy to test free\busy availability using Outlook. The above article on manual OATH configuration can be also useful for checking if things are configured properly (but really, you should always use HCW!)

If you are working in Teams calendar directly and you try to invite other on-prem users to a Teams meeting, your users/identities need to be synced with Azure AD Connect to be visible in Teams. While you can type the full email address from an on-prem user to invite them, if this mail domain is an accepted domain in O365 and there is no recipient in O365, mail delivery will fail with unknown recipient as the lookup will be done in O365 Global Address Book. Mailbox itself doesn’t need to be moved to EXO, but the identity should be synced.

Hope this helps in troubleshooting your Teams integration with on-premises mailboxes!

I wanted to thank Rui Andre Tabares, João Loureiro, Ralf Leistner, Nino Bilic and Mirela Buruiana for their review of this post.

Viktoria Gindosova and Dmitry Chernikov

22 Comments
Contributor

one additional thing, if you are using a reverse proxy such as a KEMP load balancer then you have to ensure that auth to autodiscover is delegated to the exchange server, otherwise the OAuth will not work.

There is one more, which can block Teams and Exchange ONPrem calendar

  • You have many Exchange Domains OnPrem
  • You use "autodiscover redirect" to handle that (menas, the autodiscover.example.com does resolve to a HTTP-only (no certificate, no port 443)-Server which issues a "302 Found" with the target url als payload.
  • Teams Online does not use "AutodiscoverV1". it uses AutodiscoverV2 against the OnPremises Server but does not handle a "302 redirect" propertly.
    So you have to publish AutodiscoverV2 with a certificate for every domain (Think about traeffik with let's encrypt if you cannot add all names into an SAN-Certificate

Some other thinks to check

  • Check the teams Mode. It should be Island, TeamsOnly or SfbwithTeamsCollabandMeeting to see an calendar tab
  • Also Admins can use AppPolicies to remove the calendar 
  • And make sure, that the "Exchange hybrid"-Checkbox is enabled in ADSync. Otherwise EXO only knows the Mail address but has no information, that there is an OnPremises Mailbox available.

All four are common issues at my helpdesk. 

New Contributor

@Viktoria and @Dima, thanks a ton for the post. This is priceless.

 

 

Senior Member

This is great. Only for hybrid or Exchange on-prem customers, what about organisations that use HEX (hosted Exchange) mailboxes? Yup there are still thousands of HEX mailboxes.

 

Granted, they should be planning to migrate to EXO but for now, they don't have a Teams calendar tab.

Microsoft

@David Bargna Hi! Do you mean, you have pre-auth configured on your KEMP load balancer and you delegate credentials (in Kerberos, NTLM... ?). Formally, pre-auth is not supported for Autodiscover and EWS. 

Contributor
 
 Hi, in this instance for autodiscover we have no pre-auth, we delegate authentication directly to the exchange server. Basically drill a hole in the firewall direct to exchange. For other services mapi, owa, ews etc we have some level of pre-auth happening on the kemp servers. 
 
 
 
 
 
 

 

Microsoft

Hi @Frank Carius  With Auto Discover V2, which was introduced with Exchange 2016 CU3, the autodiscover request is a non-authenticated request using JSON. This is why we support V2 from middle tier and have best effort support for now with V1. This is a little bit confusing and in 99% cases AutoD v2 is working. So we decided not  to create confusion and removed reference to a version from article. Thanks a lot for sharing your opinion, it make sense for customers with configuration like yours. 

Microsoft

Good day @Matthew Levy ! Initially we planned the cover most important steps you need to take into account while configure Teams Calendar with Exchange on-prem. We don't rule out creation of additional article if we have enough of demand and content :) Can I ask you, what exactly do you mean by "hosted" Exchange environment in your situation? 

Microsoft

Thanks,  @David Bargnanow it's clear enough!

Occasional Visitor

Hello, very nice article.

I would like to add one observation :

it seems that autod v2 is not AD site aware. So it means that Ews externalurl need to be setup also on non internet facing mbx. For example in multiregion datacenters EU, NA and APAC and only EU are internet facing, ews externalurl need also be setup on NA and APAC mbx also otherwise the autodiscover.json file retrieved may contains internal url when a non internet facing mbx reply.

 

Regards

Vinam799

Valued Contributor

Well this has highlighted one important fact for me.  The on-premises mailbox must be hosted on Exchange 2016 in order for this to work.  Very handy to know. Unfortunate for those customers relying on the free hybrid licence key which stiplulates that no mailboxes must be hosted on that server.  This would represent the vast majority of my customers. 

 

Thanks for posting this. :smile:

Microsoft

Good day, @Vinam799, Yes. AutoD V2 is not site aware. That would be great to have separate article on AutoD v2  in the future, as this topic is not covered very well. unfortunately, we cannot do this here. Thanks for addition!

Frequent Visitor

great post.

i have one question can i limit the connection to Exchange on-primes autodicover and EWS only from Microsoft Exchange online IP address , or it must be published to all internet ?

 

Visitor

How often and when does MS Teams check if the on-premises mailbox is discoverable?
In our environment, we see strange behaviour. The calendar can be visible for some users and can't for others at the same time. The calendar may disappear unexpectedly and return in 2-3 days without any actions. Mailboxes of users are in Exchange on-premise.
In Debug logs we see "calendarSyncService: User mailbox is not discoverable. Skipping sync UserAppsStore: Skipped calendar app with isFirstParty as true. isMailboxDiscoverable: false"
All recommendations in the article were implemented and double-checked.

Senior Member

One more thing worth to mention here is ensure that /API/* from your Exchange Farm is properly published by your Load Balancer - which is the REST API used by the Teams backend services for Out of Office / Presence Updates against your mailbox. The current config templates from F5 for example are not covering this subdirectory correctly under all conditions and you may end up with missing this on your public endpoint. Thanks to Premier Support for uncovering this little detail - thought it's worth to share here as we just ran into this issue.

Occasional Visitor

@Vinam799 The site awareness for AutodiscoverV2 is something we're looking into.

Senior Member

After configuring OAUTH on-prem users (with PTA SSO) can't save meetings - it disappears from Teams calendar after showing progress bar for couple of minutes.

Everything else works fine, users can see availibilty, rooms and manage personal calendar from Teams until they add a channel (team mailbox in EXO) to the meeting details.

Contributor

@navion your issue should not be related to OAUTH or Exchange but to mail flow.

 

When you create a meeting in Microsoft Teams and your mailbox resides on-premises, MS Teams backend service will send an appointment e-mail to your on-premises mailbox. If that e-mail can't be delivered, because of not properly configured mail flow between Exchange Online and Exchange on-premises, the meeting will not be scheduled. The effect that you see in that case is that in MS Teams client the user creates the meeting and sees the meeting to be grayed out for a certain time. After around 30 seconds, the meeting disappears as the MS Teams backend service didn't receive any response from your on-premises mailbox.. 

 

Please have a look and let me know if that could help you solve your issue

 

Kind regards

Spikar

Frequent Visitor

Calendar Tab appear but keep loading and it didn't show any data i check logs Calendar App was there and isMailboxDiscoverable: true but i see below error , any idea ?

i used new HCW ver17.xx without any issue.

 
{"errorCode":"ErrorNonExistentMailbox","message":"Error while fetching appointments from EWS. ResponseCode: NoError, ErrorCode: ErrorNonExistentMailbox, ErrorMessage: Mailbox doesn't exist"}
Senior Member

@Spiros Karampinis thank you very much! Meeting requests from team mailbox were rejected by bounce verification on Cisco ESA, so I created outbound and receive connectors to bypass the antispam appliance.

Contributor

@khalednafea please check the autodiscover of the primary domain of the users that are willing to have their calender in Microsoft Teams. 


Also check the connectivity with the Microsoft Connectivity Analyser : https://testconnectivity.microsoft.com/

 

MS Teams backend services are using Autodiscover v2 to find the mailbox on-premises. So Autodiscover should work properly, some times not properly configured DNS entries, load balancers, reverse proxies or even certificate issues could lead to a not properly working autodiscover for your Exchange infrastructure. 

 

Please let us know your progress

 

Kind regards

Spikar

Contributor

@navion you are more than welcome sir, glad that you could solve your issue.

 

Have a great day

 

Spikar