Cross-Tenant Mailbox Migration - HTTP 401 Unauthenticated during Test-MigrationServerAvailability
We are performing a Cross-Tenant Exchange Online mailbox migration between two Microsoft 365 tenants. The migration endpoint is configured with ApplicationId authentication and validates successfully. When running: Test-MigrationServerAvailability -Endpoint "MexicoToPortugal" -TestMailbox "<user>" the test consistently fails with: StatusCode="Unauthenticated" HTTP Status Code: 401 We reproduced the issue with two different users. We have already validated: - MailUser configuration - ExchangeGuid - LegacyExchangeDN (X500) - ExternalEmailAddress - Accepted Domains - Organization Relationships - Migration Endpoint - Enterprise Application - Mailbox.Migration permission - Admin Consent - Cross-Tenant Migration licensing The same HTTP 401 error occurs for multiple mailboxes after all configuration issues are corrected. Has anyone experienced a similar Cross-Tenant Mailbox Migration scenario where Test-MigrationServerAvailability returns HTTP 401 Unauthenticated even though the Enterprise Application, Mailbox.Migration permission and Admin Consent are correctly configured?Retirement of Azure Communication Services
Microsoft has announced several retirement and breaking changes in September 2026. One notable change is the retirement of Azure Communication Services as a standalone offering, scheduled to take effect on September 30, 2028. Organizations currently using Azure Communication Services should review the announcement, assess the potential impact on their environments, and begin planning accordingly. https://learn.microsoft.com/en-us/azure/communication-services/acs-retirement-and-breaking-changes-guide Which Microsoft service would be the best option for sending approximately 10,000 bulk emails per day?Retirement of Azure Communication Services
Microsoft has announced several retirement and breaking changes in September 2026. One notable change is the retirement of Azure Communication Services as a standalone offering, scheduled to take effect on September 30, 2028. Organizations currently using Azure Communication Services should review the announcement, assess the potential impact on their environments, and begin planning accordingly. https://learn.microsoft.com/en-us/azure/communication-services/acs-retirement-and-breaking-changes-guide
Sincronizzare scheda contatti dell'account di posta elettronica con active directory
Good morning, I need to update the mobile and office phone numbers for users in Active Directory and then synchronize them with the contact information in their email accounts. The goal is to ensure that when a user types an email address in Outlook and hovers their mouse over it, the phone and mobile numbers are visible in the contact card.
Exchange 2010 to Microsoft 365 Migration – Recommended Approach and Tools
I’m looking for guidance on migrating Exchange 2010 (on-premises) to Microsoft 365 / Office 365. Is a direct migration from Exchange 2010 supported, or is an intermediate hop (such as upgrading Exchange or setting up a hybrid configuration) required? Additionally, could you please recommend any reliable tools that can help with this migration? I also have a few PST files that need to be migrated as part of the process. I’d appreciate insights on best practices, common challenges, and lessons learned from real-world migrations. Thanks in advance for your help.
Get-DistributionGroup error
【I have a Exchange Online Hierarchical books below:】 Group1 ╚Group2 ╚Group3 ╚Group4 【The group all create by powershell script below and work fine till today】 $objectDistriGroup = $null $objectDistriGroup = Get-DistributionGroup - Identity $stringAlias 2>&1 #Check Alias If($objectDistriGroup -eq $null){ $objectDistriGroup = Get-DistributionGroup - Identity $stringName 2>&1 #Check Name If($objectDistriGroup -eq $null){ $objectDistriGroup = New-DistributionGroup -Name $stringName -Alias $stringAlias -Confirm:$false 2>&1 $objectDistriGroup | Set-Group -IsHierarchicalGroup $true - SeniorityIndex $stringSeniorityIndex #Add to parent group Add-DistributionGroupMember - Identity $stringParent -Member $stringAlias -Confirm:$false 2>&1 } } ) 【Today I'm trying to add "Group5" in "Group1", but got the output below in my log file】 PS>error(Invoke-WebRequest): "{"error":{"code":"NotFound","message":"Error executing cmdlet","details":{"code":"Context","target":"","message":"{¥"ClassName¥":¥"Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException¥",¥"Message¥":¥"....................................The operation couldn't be performed because object '{0}' couldn't be found on '{1}'...................................."internalexception":{"message":"Exception of type 'Microsoft.Exchange.Management.PSDirectInvoke.DirectInvokeCmdletExecutionException' was thrown." 【After some test, looks like "Get-DistributionGroup" cause these error message.】 But when I use cmdlet "Get-DistributionGroup - Identity Group5" It return "Group5" information as normal. DId I missed something update? How to fix this error. Thank you so much, Any information will be appreciated!
Permission activesync on smartphone
Hi everyone, when you grant the permissions in question to manage company email from a smartphone, do these permissions, in addition to Remote Wipe, Password Enforcement and Device Encryption (I remember these as the main ones), somehow give the Exchange administrator access to my personal data? For example, photos, any documents saved on the SD card or on the smartphone itself? Thanks in advanced!Outlook Desktop users continually prompted for credentials On-Prem Exchange SE
Battling ongoing issues with users being continually prompted for password using Outlook 2024 LTSC with on-prem Exchange 2019 SE. Removed Windows credentials, turned off cache mode, removed shared calendar(s), outlook connection status seems fine. Only (temp) workaround seems to be removing mail profile and recreating it. All other network resources on domain are fine. Any input appreciated. Thanks
Exchange SE Published Calendar URLs giving HTTP 500 error (both html and ics)
I'm getting an http 500 error when trying to browse any published calendar url. I already recreated the owa virtual directories and just updated to the latest patch level of Exchange Server SE. I did a failed request tracing for error 500 and I see the following info: When I got to that section of the web.config I see the following under rewrite: I tried using AI to "fix" this but it didn't fix anything. Can anyone offer any insite as to what's wrong here? Thanks! p.s. this was getting listed as spam so I will paste the text from the pictures in a reply belowExchange SE 15.2.2562.46: MRSProxy returns HTTP 401 after successful NTLM authentication
Hello, Anonymization note: The domain names contoso.com and contoso.local, the server name EXCH-SE-01, and the account name CONTOSO\MigrationAccount used in this post are anonymized placeholders. They do not represent the actual production domain, server, or account names. The Exchange versions, configuration values, HTTP status codes, diagnostic results, and sequence of events are unchanged. We are experiencing an issue with remote mailbox moves from Exchange Server Subscription Edition to Exchange Online. The Exchange Online migration endpoint and the following command both fail: Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer "mail.contoso.com" -Credentials $cred The error returned by Exchange Online is: The connection to the server 'mail.contoso.com' could not be completed. The call to: https://mail.contoso.com/EWS/mrsproxy.svc failed with: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was: 'Negotiate, NTLM'. The remote server returned an error: (401) Unauthorized. Environment Exchange version: Exchange Server Subscription Edition RTM Installed update: August 2026 Security Update KB5121573 Binary version: 15.2.2562.46 Topology: Single Exchange server Mailbox role Classic Full Hybrid Operating system: Windows Server 2022 Exchange Online migration type: Remote Move / onboarding The environment does not have separate frontend and backend Exchange servers. Both the Client Access frontend and mailbox backend services are hosted on the same Exchange server. All checked MRS binaries have the same version: Microsoft.Exchange.MailboxReplicationService.dll Microsoft.Exchange.MailboxReplicationService.Common.dll Microsoft.Exchange.MailboxReplicationService.ProxyClient.dll Microsoft.Exchange.MailboxReplicationService.ProxyService.dll MSExchangeMailboxReplication.exe File version: 15.2.2562.46 MRSProxy configuration Get-WebServicesVirtualDirectory | Format-List Identity, MRSProxyEnabled, BasicAuthentication, WindowsAuthentication, WSSecurityAuthentication, OAuthAuthentication, ExternalUrl Current configuration: MRSProxyEnabled : True BasicAuthentication : False WindowsAuthentication : True WSSecurityAuthentication : True OAuthAuthentication : True ExternalUrl : https://mail.contoso.com/EWS/Exchange.asmx Extended Protection settings have been validated by the latest Exchange Health Checker: Default Web Site/EWS: Extended Protection = Allow SSL flags = Ssl, Ssl128 Authentication = Windows, Negotiate, NTLM Exchange Back End/EWS: Extended Protection = Require SSL flags = Ssl, Ssl128 Authentication = Windows, Negotiate, NTLM Anonymous authentication = enabled Exchange Health Checker reports: Exchange SE RTM Aug26SU Build Number: 15.2.2562.46 MRS Proxy Enabled: True Extended Protection configured correctly for EWS Default Web Site: Started Exchange Back End: Started MSExchangeServicesAppPool: Started Local MRS health All local MRS health checks pass: Get-MailboxServer | Test-MRSHealth | Format-Table Check,Passed,Message -Wrap Results: ServiceCheck : Passed RPCPingCheck : Passed MRSProxyPingCheck : Passed QueueScanCheck : Passed Migration accounts The test was performed with two different on-premises accounts. Both accounts return the same HTTP 401 result. The primary migration account: Enabled : True LockedOut : False PasswordExpired : False The account is also a direct member of: Organization Management One of the accounts used for testing also has domain administrative permissions, so the symptom does not appear to be caused by missing Exchange RBAC permissions. Changing the password and updating the credentials stored in the migration endpoint did not change the result. Failed Request Tracing results Failed Request Tracing was enabled temporarily for Default Web Site. The MRSProxy request is processed in three stages. Stage 1: anonymous request The initial anonymous request to: /EWS/mrsproxy.svc returns HTTP 401, which appears to be the expected authentication challenge. Stage 2: NTLM negotiation The next request shows: WindowsAuthenticationModule AUTH_SSPI_CONTINUE_NEEDED HTTP 401.1 0x8009030e This also appears to be the normal intermediate NTLM challenge. Stage 3: authenticated request The final request shows: Authentication type : Negotiate NTLMUsed : true AUTH_SUCCEEDED : true RemoteUserName : DOMAIN\MigrationAccount AuthUserName : DOMAIN\MigrationAccount The Exchange frontend also calculates the expected backend server. However, after authentication succeeds, the request ends with: ModuleName : ManagedPipelineHandler Notification : EXECUTE_REQUEST_HANDLER HttpStatus : 401 HttpSubStatus : 0 ErrorCode : 0 Therefore, Windows Authentication appears to complete successfully. The final HTTP 401 is returned later, while the Exchange/WCF MRSProxy handler is executing. No corresponding failed domain logon events are recorded in the Windows Security log. No new ASP.NET event stating: MRS proxy service is disabled is generated for the current requests. Additional checks already completed We have already verified the following: MRSProxyEnabled=True Test-MRSHealth passes Two migration accounts tested Migration account is in Organization Management Basic Authentication enabled temporarily for testing Windows Authentication enabled Negotiate and NTLM providers present Frontend Extended Protection set to Allow Backend Extended Protection set to Require Frontend TLS certificate valid Backend port 444 certificate valid MSExchangeServicesAppPool running Mailbox Replication Service running EWS physical paths valid WCF *.svc handler mapping present MRS binaries present and version-consistent Exchange server fully restarted IIS restarted MRSProxy disabled and enabled again Temporarily enabling Basic Authentication did not change the result. Using another migration account did not change the result. The dedicated Exchange hybrid application and Microsoft Graph hybrid flow are also configured and Test-OAuthConnectivity succeeds. We understand that this configuration is not used for MRS remote mailbox moves. August 2026 SU known issue We reviewed the Exchange Team announcement for the August 2026 Security Update. The article mentions that MRS migrations can fail if a backend mailbox server has the August 2026 SU while the frontend Exchange server proxying the connection is on an older build. This does not seem to match our topology because this is a single Exchange server and all MRS components are on version 15.2.2562.46. The error is also HTTP 401 rather than TooManyTransientFailureRetriesPermanentException. Questions Has anyone observed the following behavior after installing Exchange SE August 2026 SU, KB5121573? MRSProxyEnabled=True Test-MRSHealth passes NTLM authentication reaches AUTH_SUCCEEDED ManagedPipelineHandler returns final HTTP 401.0 Test-MigrationServerAvailability fails In particular: Is there a known issue in KB5121573 related to MRSProxy authorization after successful NTLM authentication? Does MRSProxy require any additional authorization configuration introduced by the August 2026 security changes? Is there a supported way to validate the MRSProxyAuthorizationManager decision? Are there additional diagnostic logs that show why the WCF MRSProxy handler returns HTTP 401 after AUTH_SUCCEEDED? Is reapplying KB5121573 the recommended repair action in this situation? Has anyone resolved the issue without recreating the EWS virtual directory or disabling Extended Protection? We have retained the following diagnostic evidence and can provide sanitized excerpts: Exchange Health Checker TXT/XML Test-MigrationServerAvailability output Test-MRSHealth output Frontend EWS Failed Request Tracing EWS HttpProxy logs EWS and backend IIS configuration MRS binary versions and hashes Any guidance or confirmation from the Exchange Team or administrators who encountered the same behavior would be appreciated. Thank you.
