Error configuring OAuth from Exchange 2016 (AADSTS700027)

Mikkel Andreasen | Modulo ApS 6 Reputation points
2021-03-17T17:31:28.72+00:00

Hi,
I'm in the process of configuring OAuth from en on-premises Exchange 2016 CU19+ install to in order to have calendar integration within Microsoft Teams.
The HCW wizard has completed successfully, but no calender tab is visible within the Teams client (thick or web - same issue).

I've tested with

Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox mailbox@localdomain.tld 

And the error is

AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: xxxxxxxxx

I've tried verifying the certificate used for OAuth and it looks OK.

Running this command I've saved the certificate and compared it to the thumbprint from get-authConfig - they match and have not expired

Get-MsolServicePrincipalCredential -ServicePrincipalName "00000002-0000-0ff1-ce00-000000000000" -ReturnKeyValues $true

I'm kind of stumped as to how to solve this issue.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,485 questions
0 comments No comments
{count} vote

6 answers

Sort by: Most helpful
  1. Andy David - MVP 144.7K Reputation points MVP
    2021-03-17T17:34:13.843+00:00
    1 person found this answer helpful.
    0 comments No comments

  2. Mikkel Andreasen | Modulo ApS 6 Reputation points
    2021-03-17T17:48:36.217+00:00

    Wow! That was quick.

    I've already tried the test connectivity, and that gives the following error

    The specified user mailbox is marked as undiscoverable by the Teams middle-tier service.

    Running through the troubleshooting tips from https://learn.microsoft.com/en-us/microsoftteams/troubleshoot/known-issues/teams-exchange-interaction-issue
    I get to step number two
    Invoke-RestMethod -Uri "https://autodiscover.domain.tld/autodiscover/autodiscover.json?Email=mymailbox@keyman .tld&Protocol=EWS&RedirectCount=5" -UserAgent Teams

    Running it from a computer within the domain I get the following error
    78888-image.png

    Running the same command from a computer outside of the windows domain, it completes as expected

    0 comments No comments

  3. Andy David - MVP 144.7K Reputation points MVP
    2021-03-17T18:15:04.937+00:00

    Hmmm, I wonder if you should open a ticket with 365 support. I havent seen that one before

    0 comments No comments

  4. Mikkel Andreasen | Modulo ApS 6 Reputation points
    2021-03-17T18:21:29.93+00:00

    Doing the invoke-restmethod failed, but I've tried the same URI from a regular browser, and that completes as expected
    78808-image.png

    I was looking through the next step, https://testconnectivity.microsoft.com/tests/TeamsCalendarMissing/input
    but cannot quite figure out how to do it as I have NO on-line mailboxes. Only On-premises.

    We actually do not need the hybrid configuration - only OAuth, but that is the supported way of configuring it so we completed the HCW.

    0 comments No comments