question

AdamTyler-3751 avatar image
0 Votes"
AdamTyler-3751 asked EricYin-MSFT commented

ActiveSync and Autodiscover

Hello, I've got a question in regard to ActiveSync and Autodiscover. Consider the below diagram, I am walking through a design to migrate over from Exchange 2010 to 2016. You'll notice that there is no direct TCP:443 access from the public internet to Exchange 2016, I'm using a reverse proxy device to connect clients via ActiveSync and OWA only. The Outlook client itself will only ever connect over VPN.

The service URLs for Exchange 2016 have all been configured with a common FQDN, post.domain.com. Including the ClientAccessService/Autodiscover URL. However, with the exception of the ActiveSync ExternalURI field, all other ExternalURIs have been set to $null.

I don't plan to create an autodisover.domain.com record internally or externally, the hope being that Outlook clients can retrieve the necessary connection info with access to Active Directory DNS(SRV records). Since they are only allowed to sync Outlook while on VPN.

We rely on an MDM management tool to push out ActiveSync configurations to all mobile devices, so no reliance on Autodiscover there either. So in this example, you can see that the reverse proxy URL on the public internet is as1.subdomain.domain.com. Whereas the internal service URL name is post.domain.com, which the reverse proxy device connects to and resolves internally.

My question is this... Let's say an ActiveSync capable device happened to run the VPN client and now has access to internal DNS/SRV records. Can I expect the ActiveSync device to interact with Autodiscover at any level and overwrite the publicly resolvable as1.subdomain.domain.com to post.domain.com? This would in effect break ActiveSync once the VPN client was disconnected.


80308-exchdiagram.jpg


office-exchange-server-administrationoffice-exchange-server-connectivity
exchdiagram.jpg (383.3 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AshokM-8240 avatar image
0 Votes"
AshokM-8240 answered EricYin-MSFT commented

Hi @AdamTyler-3751 ,

Based on my knowledge, the answer is yes. If the Activesync device has the connectivity to the internal DNS, it can connect using Autodiscover SRV method which is one of the discovery steps.

https://docs.microsoft.com/en-us/previous-versions/office/developer/exchange-server-interoperability-guidance/hh352638(v=exchg.140)

Alternatively, you can also try pushing the ActiveSync endpoint, http://post.domain.com/Microsoft-Server-ActiveSync using MDM once connected over VPN and see if that works. This is nothing but a manual configuration.

If the above answer is helpful, please click on "Accept Answer" and upvote it. Thanks for understanding.

· 5
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

So I’ve been researching this quite a bit. I agree with you that if the ActiveSync device finds an autodiscover XML file using either domain.com, autodiscover.domain.com, or SRV I can expect the settings to get updated with the incorrect address.

Only catch is that none of those autodiscover records exist in both External and Internal DNS. The SRV record isn’t present internally either. I thought this was created automatically, but apparently not.

The only way Outlook clients on domain joined systems are locating Exchange is via the SCP or service connection point set in Active Directory Sites and Services. My hope is that a non-domain joined ActiveSync device won’t ever look at the SCP.

Regards,
Adam Tyler

0 Votes 0 ·

There is no non-domain joined ActiveSync to my knowledge. For ActiveSync to work, you need to have the external DNS for auto discover and externalURL of ActiveSync virtual directory. If external is not allowed and VPN profile will be pushed through MDM then it needs to connect to internal DNS to reach the Exchange. It cannot connect using SCP. Either DNS or Manual configuration.

0 Votes 0 ·

I've confirmed that in order for ActiveSync to function it DOES NOT require an autodiscover record whether it be an "A" record or SRV record. I have an extensive lab built with a few Android devices, they are happily doing ActiveSync without AutoDiscover by manually programming the URL into the ActiveSync profile.
-Adam

0 Votes 0 ·
Show more comments
EricYin-MSFT avatar image
0 Votes"
EricYin-MSFT answered AdamTyler-3751 commented

Hi,
When I check the procedure that Autodiscover processes for Exchange ActiveSync clients, it seems the url that Outlook client connecting to cannot be customized.
Since you don't have DNS records for autodiscover.domain.com, it should fail in the step1,2,3 and try connecting to the url in srv record. What do you set for that?
You've got MDM to apply configuration for all devices, do you mean manually specify the server inforamtion?
The official doc above may not apply for you situation, you can try enabling ActiveSync device log and testing in EXRCA.



If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @EricYin-MSFT, It doesn’t look like the SRV record exists either. Only using the SCP address which appears to be set in the Active Directory database as a result of running the set-ClientAccessService cmdlet.

Regards,
Adam Tyler

0 Votes 0 ·