Testing Outlook Mobile Hybrid Modern Authentication (HMA) failed

Question

Running Microsoft Remote Connectivity Analyzer ends with this error message:

Analyzing the Bearer token response from the on-premises Exchange ActiveSync (EAS) service.

Analyzing the Bearer token response from the on-premises Exchange ActiveSync (EAS) service failed.

Additional Details

The Bearer response header did not contain the expected authorization URL value login..../common/ oauth2 / authorize

I have successfully ran the HCW recently and Test-OAuthConnectivity works just fine.

Answer 1

Hi @Huig Guijt

Thank you for posting your question in the Q&A Forum. 

While the Remote Connectivity Analyzer can be strict with header validation, the specific error about the missing authorization URL generally indicates that the ActiveSync virtual directory is not correctly advertising OAuth.

This can occur even when the Hybrid Configuration Wizard and Test-OAuthConnectivity both succeed. Those tests confirm the OAuth trust, but Hybrid Modern Authentication for Outlook Mobile also requires the ActiveSync (EAS) virtual directory to broadcast OAuth support.

Please verify the following on your Exchange server (run in an elevated Exchange Management Shell):

Get-ActiveSyncVirtualDirectory | FL Identity, ExternalURL, InternalAuthenticationMethods, ExternalAuthenticationMethods

If OAuth is not listed in either InternalAuthenticationMethods or ExternalAuthenticationMethods, HMA will not initiate correctly for Outlook Mobile even if the hybrid trust is fully established.

You can enable OAuth for both methods with:

Set-ActiveSyncVirtualDirectory -Identity "ServerName\Microsoft-Server-ActiveSync (Default Web Site)" `
    -InternalAuthenticationMethods Basic,OAuth `
    -ExternalAuthenticationMethods Basic,OAuth
iisreset

Note: Replace ServerName with your actual server’s name. This RCA error is commonly seen when OAuth is enabled at the organization level but not on the EAS virtual directory.

For deeper validation, you may also use Microsoft’s Test‑HMAEAS script, which provides more precise insight into how the Bearer challenge is returned: https://microsoft.github.io/CSS-Exchange/Hybrid/Test-HMAEAS/

Feel free to update the thread with the result of the OAuthAuthentication check.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

The error you are encountering with the Bearer token response from the on-premises Exchange ActiveSync (EAS) service indicates that the expected authorization URL value is missing. This could be due to several reasons related to the configuration of your on-premises environment.

Here are some troubleshooting steps you can take:

1. Check AutoDiscover and ActiveSync Configuration: Ensure that your AutoDiscover and ActiveSync endpoints are correctly configured. If the AutoDiscover endpoint can't be reached, there may be firewall or load balancer issues.
2. Verify the ActiveSync Endpoint: Make sure that the ActiveSync endpoint is returning the correct authorization URL. You can check this by executing the appropriate scripts to validate the Hybrid Modern Authentication setup.
3. EvoSTS Configuration: Verify that the EvoSTS authentication server is configured correctly as the default endpoint. You can check this using the Exchange Management Shell command: Get-AuthServer EvoSts | Format-List IsDefaultAuthorizationEndpoint.
4. SSL/TLS Offloading: If SSL/TLS offloading is in place, it may cause issues with the Bearer token due to mismatched protocol values. Ensure that SSL/TLS offloading is not interfering with the OAuth flows.
5. Refresh Auth Metadata: If the EvoSTS certificate metadata is out of date, you can refresh it manually using the command: Set-AuthServer EvoSts -RefreshAuthMetadata.

Since you mentioned that Test-OAuthConnectivity works fine, it suggests that the basic OAuth configuration is correct, but there may be specific issues with the ActiveSync setup or the Bearer token response.

Following these steps should help you identify and resolve the issue with the Bearer token response.