Skip to content

Commit 0ed2d27

Browse files
authored
Adding the generic autodiscover URI to the list
I had a client who did not use the autodiscover.domain.com value internally as the article here says to add your internal domains - but now that Basic Auth has been switched off for AutoDiscover, you need the autodiscover.contoso.com value added as well or you get a sign-in error when Outlook tries to do AutoDiscover. So you need to include you internal and external domains which includes AutoDiscover, so added something to here to call this out more clearly
1 parent cbb266c commit 0ed2d27

1 file changed

Lines changed: 4 additions & 3 deletions

File tree

microsoft-365/enterprise/configure-exchange-server-for-hybrid-modern-authentication.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,16 +93,17 @@ Ensure the URLs clients may connect to are listed as HTTPS service principal nam
9393
Get-MsolServicePrincipal -AppPrincipalId 00000002-0000-0ff1-ce00-000000000000 | select -ExpandProperty ServicePrincipalNames
9494
```
9595

96-
Take note of (and screenshot for later comparison) the output of this command, which should include an `https://*autodiscover.yourdomain.com*` and `https://*mail.yourdomain.com*` URL, but mostly consist of SPNs that begin with `00000002-0000-0ff1-ce00-000000000000/`. If there are `https://` URLs from your on-premises that are missing, those specific records should be added to this list.
96+
Take note of (and screenshot for later comparison) the output of this command, which should include an `https://*autodiscover.yourdomain.com*` and `https://*mail.yourdomain.com*` URL, but mostly consist of SPNs that begin with `00000002-0000-0ff1-ce00-000000000000/`. If there are `https://` URLs from your on-premises Exchange Server organization that are missing, those specific records should be added to this list.
9797

98-
3. If you don't see your internal and external MAPI/HTTP, EWS, ActiveSync, OAB, and Autodiscover records in this list, you must add them using the command below (the example URLs are `mail.corp.contoso.com` and `owa.contoso.com`, but you'd **replace the example URLs with your own**):
98+
3. If you don't see your internal and external MAPI/HTTP, EWS, ActiveSync, OAB, and Autodiscover records in this list, you must add them using the command below (the example URLs are `mail.corp.contoso.com` and `owa.contoso.com`, but you'd **replace the example URLs with your own**). Ensure that the generic AutoDiscover record for your domain (for example `autodiscover.contoso.com`) is included as well:
9999

100100
```powershell
101101
$x= Get-MsolServicePrincipal -AppPrincipalId 00000002-0000-0ff1-ce00-000000000000
102102
$x.ServicePrincipalnames.Add("https://mail.corp.contoso.com/")
103103
$x.ServicePrincipalnames.Add("https://owa.contoso.com/")
104+
$x.ServicePrincipalnames.Add("https://autodiscover.contoso.com/")
104105
Set-MSOLServicePrincipal -AppPrincipalId 00000002-0000-0ff1-ce00-000000000000 -ServicePrincipalNames $x.ServicePrincipalNames
105-
```
106+
```
106107

107108
4. Verify your new records were added by running the `Get-MsolServicePrincipal` command from step 2 again, and looking through the output. Compare the list / screenshot from before to the new list of SPNs. You might also take a screenshot of the new list for your records. If you were successful, you will see the two new URLs in the list. Going by our example, the list of SPNs will now include the specific URLs `https://mail.corp.contoso.com` and `https://owa.contoso.com`.
108109

0 commit comments

Comments
 (0)