Blog Post

Exchange Team Blog
3 MIN READ

Released: April 2024 Exchange Server Hotfix Updates

The_Exchange_Team's avatar
The_Exchange_Team
Icon for Microsoft rankMicrosoft
Apr 23, 2024

Microsoft has released Hotfix Updates (HUs) that enable support for new functionality and address issues in the March 2024 Security Update (SU).

The April 2024 HU is available for the following builds of Exchange Server:

New Features

The April 2024 HU introduce support for elliptic curve cryptography (ECC) certificates and hybrid modern authentication for Outlook on the web and ECP.

Support for ECC certificates

Starting with April 2024 HU, Exchange Server 2016 and Exchange Server 2019 now support ECC certificates except when used in Active Directory Federation Services (AD FS) scenarios.

Hybrid Modern Authentication (HMA) for OWA/ECP

We are also announcing that starting with April 2024 HU, HMA for OWA/ECP is also supported. This feature requires Exchange 2019 CU14 + April 2024 HU (or later). Please see the feature documentation for more information.

Issues Addressed

The April 2024 HU also addressed issues that have been reported since the release of March 2024 Security Updates for Exchange Server. The following issues in the March 2024 SUs are addressed in this HU:

March 2024 SU issue that we still need to resolve:

  • Calendar printing in OWA might not work unless CTRL+P keyboard shortcut is used. We will address this in a future update.

April 2024 Hotfix Update FAQ

This is the first HU released for Exchange Server, so to help you decide if you should install this update, we have prepared the following questions and answers:

We installed the March 2024 SU. Should we install the April 2024 HU?
The April 2024 HU is an optional update, but it does also introduce support for ECC certificates and HMA for OWA/ECP. If you installed the March 2024 SU but did not experience any of known issues and you don’t need the new functionality, you do not need to install the April 2024 HU and can wait until the future SU (which will include known issue fixes from April HU).

We did not yet install the March 2024 SU. Do we have to install the March SU first before installing the April 2024 HU?
The April 2024 HU includes the same security updates as the March 2024 SU, while addressing known issues with the March 2024 SU. If you did not install the March 2024 SU, you can install the April 2024 HU directly and skip the March 2024 SU.

Our Exchange servers update automatically through Windows / Microsoft Update. We installed the March 2024 SU already. Will our servers automatically install the April 2024 HU?
The April 2024 HU will appear as an optional update for your servers. The update is now also available on the Microsoft Update Catalog (search for KB5037224) and Windows Update.

Does the April 2024 HU contain any security updates not included in the March 2024 SU?
The security content of the April 2024 HU is the same as in March 2024 SU.

Will the two new features (support for ECC certificates and HMA for OWA/ECP) also be rolled into future updates, or must we install this specific HU to get them?
The April 2024 HU will be included in subsequent updates for Exchange Server. We are simply announcing that those two features are now supported starting with April 2024 HU.

Can April 2024 HU be uninstalled (if the need arises)?
Yes. HUs, like SUs, can be uninstalled.

Please see the March 2024 SU release blog post for installation tips and information related to security fixes included.

Documentation may not be fully available at the time this post is published.

Updates to this blog post:

  • 5/6/2024: Added information that April 2024 HU is now also available on Microsoft Update Catalog and Windows Update.

The Exchange Server Team

Updated May 06, 2024
Version 4.0
announcements
exchange 2016
exchange 2019
on premises
security
  • Sam_T's avatar
    Sam_T
    Iron Contributor
    Apr 26, 2024

    The_Exchange_Team 

     

    The following issues in the March 2024 SUs are addressed in this HU:

     

    • Download domains not working after installing the March 2024 SU
    • "We can't open this document" error in OWA after installing March 2024 SU
    • Search error in Outlook cached mode after installing March 2024 SU
    • OwaDeepTestProbe and EacBackEndLogonProbe fail after installing March 2024 SU
    • Outlook doesn't display unread envelope icon after installing Microsoft Exchange Server March 2024 SU
    • My Templates add-in isn't working after installing Microsoft Exchange Server March 2024 SU
    • Published calendars might not work with a "This calendar isn't available" error after installing March 2024 SU
    • March 2024 SU issue that we still need to resolve: Calendar printing in OWA might not work unless CTRL+P keyboard shortcut is used. We will address this in a future update.

     

    How is it possible that a company with a 3 trillion dollar market cap can continue to produce updates like the Microsoft Exchange Server March 2024 SU ?    There is obviously no meaningful QA being done on any of these updates and you leave it to your customers to perform this function on their own dime and at risk to their business. I am certain that many of the commenters here could provide better QA than you have ever.  There also doesn’t seem to be any embarrassment at what is being produced and no apology for the amount time and $ your customers waste on these updates that have proven to be one fiasco after another.

  • broland's avatar
    broland
    Iron Contributor
    Apr 24, 2024

    LukasSMSFT I can confirm the HealthChecker is now reporting the ECC certificate properly.  Thanks!

  • Lennart-Live1220's avatar
    Lennart-Live1220
    Copper Contributor
    Apr 24, 2024

    Hello all,

    All is working fine with us now after we implemented the April Hotfix Update. Download domains is also enabled again.

    4ppl3c0r3 Also the preview function is okay.

    Thank you!

     

     

  • AC1CT's avatar
    AC1CT
    Copper Contributor
    May 03, 2024

    Nino_Bilic - Thanks for the hint on extracting the MSP file.

     

    In case anyone else needs it, it's not as straightforward as you'd think. You run the executable from an elevated command prompt on a non-Exchange machine, and you'll get a dialog box that indicates the install failed because it couldn't find Exchange. The key is ** don't click the OK button on that dialog box. ** Look in the command prompt and you'll see where it extracted ExchangeServer.msp. Go grab the file and copy it somewhere else. As soon as you click OK, it deletes the file from the location it indicates. I went through this a few times before figuring it out. Just in case it helps someone else!

  • Nino_Bilic's avatar
    Nino_Bilic
    Icon for Microsoft rankMicrosoft
    May 09, 2024

    SuperCaco We hear the need for DKIM/DMARC very clearly. Nothing to announce at this time, but know that we heard it.

  • LukasSMSFT's avatar
    LukasSMSFT
    Icon for Microsoft rankMicrosoft
    May 22, 2024

    dubilava1655 make sure to update all of them to the latest version. Exchange Server 2016 CU20 is very old and we've made many changes with the latest version (CU23 + April 2024 HU) compared to CU20. 

     

    srfndoc Global_Helpdesk I can confirm that the issue with the piped cmdlet still exists in the latest update (April 2024 HU). We've updated the documentation (updated version will become available within the next few hours) to reflect this issue (https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-serialization-payload-sign?view=exchserver-2019#exchange-server-2016-cu23--2019-cu13-or-cu14--march-2024-or-later-su--hu). 

    The ECC certificate POP/IMAP issue is still under investigation.

  • Nino_Bilic's avatar
    Nino_Bilic
    Icon for Microsoft rankMicrosoft
    Apr 23, 2024

    ceantuco That is all covered in the FAQ above. This is totally up to you. You make an assumption that there is a "May SU". There might be, or not. We do not pre-announce those.

    If you had issues with March SU, then install April HU. If you did not install March SU, then you should install April HU, as it will address security payload from March 2024. We always want you to run the latest security bits.

  • bbzome's avatar
    bbzome
    Copper Contributor
    Apr 23, 2024

    Hi!!!


    I'm very happy to finally see OWA/ECP HMA alive!

    Is there any way to make OWA/ECP redirect to my company branded Microsoft Entra ID authentication page instead of the standard one?

    Basically, I just need to add "&domain_hint=example.com" to the redirect URL.