PowerShell EWS AutoDiscoverURL Error

Question

PowerShell EWS AutoDiscoverURL Error

Jairo Javier Baleta Cali 26

Good afternoon.

I hope you are well.

I am looking for the option to access an Outlook mailbox (Exchange) through a token without having to enter the credentials of a user. With the following code:

$TenantId = “xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx”
$AppClientId = “xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx”
$ClientSecret = “xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx”

$RequestBody = @{client_id=$AppClientId;client_secret=$ClientSecret;grant_type=”client_credentials”;scope=”https://graph.microsoft.com/.default”;}
$OAuthResponse = Invoke-RestMethod -Method Post -Uri https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token -Body $RequestBody
$AccessToken = $OAuthResponse.access_token

Import-Module "C:\Program Files\Microsoft\Exchange\Web Services2.2\Microsoft.Exchange.WebServices.dll"

$MailboxName ="usuario@dominio.onmicrosoft.com"
$Service = [Microsoft.Exchange.WebServices.Data.ExchangeService]::new()
$Service.Credentials = [Microsoft.Exchange.WebServices.Data.OAuthCredentials]$AccessToken
$Service.Url = “https://outlook.office365.com/EWS/Exchange.asmx”
$Service.AutodiscoverUrl($MailboxName,{$true})

It is throwing the following error:

Exception calling "AutodiscoverUrl" with arguments "2": "The Autodiscover service couldn't be located."
Online: 29 Character: 1
+ $Service.AutodiscoverUrl($MailboxName,{$true})
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
     + FullyQualifiedErrorId : AutodiscoverLocalException

I hope you can help me

Jarvis Sun-MSFT 3,691 Reputation points Microsoft Vendor

2023-05-17T06:11:41.2966667+00:00

To solve your problem faster, I added the Exchange server development tag.
Jairo Javier Baleta Cali 26 Reputation points

2023-05-17T16:04:01.6366667+00:00

Hi Jarvis

Thank you very much for answering.

The connection I'm making is against Microsoft 365 Exchange Online

The error is generated by the line $Service.AutodiscoverUrl($MailboxName,{$true}). I have not been able to find if it is due to some special permission that the Azure App needs, so that it can connect with the application token, without using the credentials of a user and thus be able to establish the execution of the Script in a scheduled and unattended way.

Jarvis Sun-MSFT 3,691 Reputation points Microsoft Vendor

2023-05-17T06:11:41.2966667+00:00

To solve your problem faster, I added the Exchange server development tag.
Jairo Javier Baleta Cali 26 Reputation points

2023-05-17T16:04:01.6366667+00:00

Hi Jarvis

Thank you very much for answering.

The connection I'm making is against Microsoft 365 Exchange Online

The error is generated by the line $Service.AutodiscoverUrl($MailboxName,{$true}). I have not been able to find if it is due to some special permission that the Azure App needs, so that it can connect with the application token, without using the credentials of a user and thus be able to establish the execution of the Script in a scheduled and unattended way.

Answer 1

Vasil Michev 71,216 MVP

You can just hardcode the EWS URL, it's the same for all Exchange Online mailboxes.

Jairo Javier Baleta Cali 26 Reputation points

2023-05-18T13:39:29.9933333+00:00

Good morning Vasil

Thank you very much for the reply.

I have tried to do it. But I haven't found the coding that allows me to do it via the token of an azure app.
Vasil Michev 71,216 Reputation points MVP

2023-05-18T14:47:36.9833333+00:00

Token doesn't matter here. It's the same value for all, no need to look it up. Just set it and forget about it.

$Service.Url = “https://outlook.office365.com/EWS/Exchange.asmx”

^^ this is all you need.
Jairo Javier Baleta Cali 26 Reputation points

2023-05-18T15:04:24.0566667+00:00

Thank you very much for answering.

Currently I have added this same line ($Service.Url = “https://outlook.office365.com/EWS/Exchange.asmx”) but it keeps getting the same error.
Vasil Michev 71,216 Reputation points MVP

2023-05-18T15:12:45.17+00:00

Did you remove the next line?

$Service.AutodiscoverUrl($MailboxName,{$true})

You do NOT need it.
Jairo Javier Baleta Cali 26 Reputation points

2023-05-18T15:42:22.1433333+00:00

Thank you very much for answering.

But when placing the following lines again it outputs an error:

$folderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox,$MailboxName)

$InboxFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderid) Error: Exception calling "Bind" with arguments "2": "The request failed. Remote server error: (401) Unauthorized."

The error is thrown by the line: $InboxFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderid)
Vasil Michev 71,216 Reputation points MVP

2023-05-18T15:54:09.5966667+00:00

Did you configure impersonation? Since you are running in the app context, you need to add the impersonation header before accessing any given mailbox. I.e.:

$Service.ImpersonatedUserId = New-Object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, "user@domain.com")
Jairo Javier Baleta Cali 26 Reputation points

2023-05-18T16:39:52.7066667+00:00

Thank you very much for answering.

I have the code as follows:

Import-Module 'C:\Tools\microsoft.exchange.webservices.2.2.0\lib\40\Microsoft.Exchange.WebServices.dll'

$Service = [Microsoft.Exchange.WebServices.Data.ExchangeService]::new()

$Service.Credentials = [Microsoft.Exchange.WebServices.Data.OAuthCredentials]$accesstoken

$Service.TraceEnabled = $true

$Service.Url = "https://outlook.office365.com/EWS/Exchange.asmx"

$Service.ImpersonatedUserId = New-Object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress,$MailboxName)

$folderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox,$MailboxName)

$InboxFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($Service,$folderid)

But still getting the error:

Exception calling "Bind" with arguments "2": "The request failed. Remote server error: (401) Unauthorized."

On the line:

$InboxFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($Service,$folderid)
Vasil Michev 71,216 Reputation points MVP

2023-05-19T07:39:38.9833333+00:00

Decode your token via jtw.ms and paste the sanitized result here.
Jairo Javier Baleta Cali 26 Reputation points

2023-05-19T16:41:21.57+00:00

Thank you very much for answering.

Sorry for the lack of knowledge. What is jtw.ms?
Vasil Michev 71,216 Reputation points MVP

2023-05-20T06:04:01.0733333+00:00

Sorry, that's supposed to be jwt.ms - a website where you can decode your access tokens and see the internal claims. Once you obtain a token, paste it therein and copy the result so we can verify the permissions are correctly granted. Do not post the encoded token here :)

Jairo Javier Baleta Cali 26

Thank you very much for answering.

This is the result obtained in https://jwt.ms/ :

{
   "typ": "JWT",
   "nonce": "61WPxLBF3zkiP7ZT4Ulo242Z02XBaaHeKxD3mumKc_E",
   "alg": "RS256",
   "x5t": "-KI3Q9nNR7bRofxmeZoXqbHZGew",
   "kid": "-KI3Q9nNR7bRofxmeZoXqbHZGew"
}.{
   "aud": "https://graph.microsoft.com",
   "iss": "https://sts.windows.net/4188b207-0645-45ad-8d06-a3ee2bfa6c8b/",
   "iat": 1684848446,
   "nbf": 1684848446,
   "exp": 1684852346,
   "aio": "E2ZgYFBlXrr10PwptbevakZNvDTnIwA=",
   "app_displayname": "MSALPS",
   "appid": "8cdc7d47-5580-43a2-b7b0-37fa19710d3e",
   "appidacr": "1",
   "idp": "https://sts.windows.net/4188b207-0645-45ad-8d06-a3ee2bfa6c8b/",
   "idtyp": "app",
   "oid": "6a5a95ab-e68c-4913-8ad8-52454d7f4004",
   "rh": "0.ATQAB7KICUUGrUWNBqPuK_psiwMAAAAAAAAAwAAAAAAAAAA0AAA.",
   "roles": [
     "Mail.ReadWrite",
     "Mail.ReadBasic.All",
     "User.Read.All",
     "Mail.Read",
     "Mail.Send",
     "Mail.ReadBasic",
     "Reports.Read.All"
   ],
   "sub": "6a5a95ab-e68c-4913-8ad8-52454d7f4004",
   "tenant_region_scope": "SA",
   "tid": "4188b207-0645-45ad-8d06-a3ee2bfa6c8b",
   "uti": "y6caUdUgq0Go2PzBB2JSAA",
   "view": "1.0",
   "wids": [
     "0997a1d0-0d1d-4acb-b408-d5ca73121e90"
   ],
   "xms_tcdt": 1410883850
}.[Signature]

Vasil Michev 71,216 Reputation points MVP

2023-05-23T14:11:23.96+00:00

Right, so you are missing the EWS permissions. Your application must have the full_access_as_app permission added, and consented to in the tenant where you plan to use it. If you need help adding the required permissions, follow the steps here: https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-authenticate-an-ews-application-by-using-oauth#configure-for-app-only-authentication
Jairo Javier Baleta Cali 26 Reputation points

2023-05-23T14:32:40.6233333+00:00

Thank you very much for answering.

I looked for it in the manifest and if you have it registered:

"requiredResourceAccess": [

{

"resourceAppId": "00000002-0000-0ff1-ce00-000000000000",

"resourceAccess": [

{

"id": "dab085de-3e14-432f-a47f-84b6457059c4",

"type": "Scope"

},

{

"id": "3b5f3d61-589b-4a3c-a359-5dd4b5ee5bd5",

"type": "Scope"

},

{

"id": "16572339-6149-452b-b084-280b01354687",

"type": "Scope"

},

{

"id": "b09ec548-3f99-4d0a-859c-c9b7ff53b7a9",

"type": "Scope"

},

{

"id": "1d894596-c906-42b1-8422-9360440c1c0c",

"type": "Scope"

},

{

"id": "185758ba-798d-4b72-9e54-429a413a2510",

"type": "Scope"

},

{

"id": "75767999-c7a8-481e-a6b4-19458e0b30a5",

"type": "Scope"

},

{

"id": "5eb43c10-865a-4259-960a-83946678f8dd",

"type": "Scope"

},

{

"id": "e843bc88-e493-446d-a73c-0ded7ff1913f",

"type": "Scope"

},

{

"id": "140e747e-90d3-4de0-8618-85a0cc7a1129",

"type": "Scope"

},

{

"id": "ad13ac2e-ad46-4dc0-b7da-249c94395a6d",

"type": "Scope"

},

{

"id": "dc890d15-9560-4a4c-9b7f-a736ec74ec40",

"type": "Role"

},

{

"id": "dc50a0fb-09a3-484d-be87-e023b12c6440",

"type": "Role"

}

]

},

The problem may be due to the disorder assigned permissions:
Vasil Michev 71,216 Reputation points MVP

2023-05-23T16:28:40.7633333+00:00
OK, a slight confusion. So you do have the Exchange Online API's EWS permissions granted, that's great. However, the code you used is for the Graph API endpoint, not the Exchange one. So, you need to either:

Use the https://outlook.office365.com/.default scope when requesting the token (follow the exact example in the article above)

or

Grant the corresponding permission on the Graph API endpoint.
Jairo Javier Baleta Cali 26 Reputation points

2023-05-25T15:34:35.2466667+00:00

Thank you very much Vasil.

It already worked for me.

Jairo Javier Baleta Cali 26

Good afternoon Vasil Michev.

I hope you are well.

I wanted to tell you that from one moment to another it stopped working. The code I have is:

Import-Module "C:\Tools\microsoft.exchange.webservices.2.2.0-2\Microsoft.Exchange.WebServices.dll"

$service = [Microsoft.Exchange.WebServices.Data.ExchangeService]::new()
$service.Credentials = [Microsoft.Exchange.WebServices.Data.OAuthCredentials]$EWSAccessToken
 
$service.Url = "https://outlook.office365.com/EWS/Exchange.asmx"

$Service.ImpersonatedUserId = New-Object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress,$mailboxName)

$folderID = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox,$mailboxName)
$inboxFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderID)

$Sfir = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo([Microsoft.Exchange.WebServices.Data.EmailMessageSchema]::IsRead, $true)

$sfCollection = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+SearchFilterCollection([Microsoft.Exchange.WebServices.Data.LogicalOperator]::And)
$sfCollection.add($Sfir)

$view = new-object Microsoft.Exchange.WebServices.Data.ItemView(2000)

$frFolderResult = $inboxFolder.FindItems($sfCollection,$view)

The line that outputs an error is:

$frFolderResult = $inboxFolder.FindItems($sfCollection,$view)

The error it generates is:

Exception calling "FindItems" with arguments "2": "The property Hashtags is valid only for Exchange Exchange2015 or later versions."

The machine where I am running it is Windows 11 Pro

Answer 2

Amit Singh 3,731

I will recommend to you enable Traces, to achieve this following:

Service.TraceEnabled = true;

I was facing the same issue then when I enabled traces. These traces will guide you on what exactly is happening. In my case, the SSL certificate issue is there to solve it. I followed the following post.

There can be many issues, such as:

Users can be blocked.

The DNS can't find autodiscover.domain.com.

Jairo Javier Baleta Cali 26 Reputation points

2023-05-18T13:40:07.6533333+00:00

Good morning Amit

Thank you very much for the answers

I implemented the line $Service.TraceEnabled = $true and it gave me the following errors:

Request error: Cannot resolve remote name: 'tenant.onmicrosoft.com'

No Autodiscover endpoints are available for host tenant.onmicrosoft.com

Request error: Unable to connect to remote server

No Autodiscover endpoints are available for host autodiscover.tenant.onmicrosoft.com

Request error: Remote server error: (401) Unauthorized.

Since it's a Microsoft 365 own domain (onmicrosoft.com) shouldn't it solve it without errors?

Answer 3

Limitless Technology 26,416

Hello there,

For O365 mailboxes, you can safely hardcode the Autodiscover URL to "https://outlook.office365.com/EWS/Exchange.asmx"

and avoid any lookup issues.

AutoDiscoverv1 doesn't support the client credentials flow so you need to remove the line

$ews.AutodiscoverUrl($MailboxName,{$true})

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--

Jairo Javier Baleta Cali 26 Reputation points

2023-05-18T14:03:47.4466667+00:00

Thank you very much for the reply.

I'm currently using these 2 lines with the same parameters as references:

$Service.Url = "https://outlook.office365.com/EWS/Exchange.asmx"

$Service.AutodiscoverUrl($mailuser,{$true})

But they throw the error: Exception calling "AutodiscoverUrl" with arguments "2": "The Autodiscover service couldn't be located."

PowerShell EWS AutoDiscoverURL Error

2 additional answers

Activity