Freebusy not work between cross-forest exchange servers

Chong 846

Hi,

We have 2 AD forest and setup the trust relationship to perform domain migration. The mailbox in forest A will migrate to forest B. The exchanges information as below

Forest A (abc.com):

Exchange 2013
email address: @xyz .com
EWS URL: mail.xyz.com
Forest B (xyz.com):
Exchange 2019
email address: @xyz .com
EWS URL: mail1.xyz.com

We tested the mailbox cam migrate from "abc.com" to "xyz.com", but the free/busy between 2 exchange forest not work.

Tried to follow below documents to add Availability Address Space and ADpermission on both exchange, but the problem didn't solve:
https://learn.microsoft.com/en-us/exchange/architecture/client-access/availability-service-for-cross-forest-topologies?view=exchserver-2019

Any idea?

Best Regards
Chong

2 answers

Amit Singh 4,846 Reputation points

2021-11-16T12:23:22.127+00:00
Configure the external URL for Exchange Web Services for the target forest. To do this, run this command in Windows PowerShell for Exchange:

Set-WebServicesVirtualDirectory -identity "server_name\EWS (Default Web Site)" -ExternalURL
Please sign in to rate this answer.
Chong 846 Reputation points

2021-11-16T13:39:35.017+00:00

Hi @Amit Singh ,

I already configure the externalURL in both exchange servers and it don't work.

Forest A (abc.com):

Exchange 2013

email address: @xyz .com

EWS internal URL: https://mail.xyz.com/ews/Exchange.asmx

EWS external URL: https://mail.xyz.com/ews/Exchange.asmx

Forest B (xyz.com):

Exchange 2019

email address: @xyz .com

EWS internal URL: https://mail1.xyz.com/ews/Exchange.asmx

EWS external URL: https://mail1.xyz.com/ews/Exchange.asmx

Best Regards
Chong
Sign in to comment
Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2021-11-17T08:57:11.637+00:00
Hi @Chong

I would suggest this link: How to Configure the Availability Service for Cross-Forest Topologies

In general, you may need to ensure:

autodiscover and EWS urls can be resolved correctly and are accessible in both forests

Exchange certificates are trusted

Permissions are configured correctly

And have you used FIM/MIM to perform a GALSync between the two forests, or manually created cross-forest contacts?
Based on my test, it is also required.

Besides, please also note that there is a known issue on the cross-forest free/busy information.
Here is the link: "(400) Bad Request" error during Autodiscover for per-user free/busy in a trusted cross-forest topology
This issue would occur on Exchange servers that have April 2021 and May 2021 security update installed.

If it is the case, please follow the workarounds in this link.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Chong 846 Reputation points

2021-11-17T09:23:24.697+00:00

Hi @Kael Yao-MSFT ,

The EWS url in both exchanges are fine. However, since forest A and forest B also using "xyz.com", the autodiscover on both of them will be "autodiscover.xyz.com". Therefore, I just use internal DNS of each domain so forest A client resolve autodiscover to forest A exchange, and forest B user resolve to forest B exchange

The certificate include both domain name and SAN already.

Do the permission means the "ms-Exch-EPI-Token-Serialization" in this documents? (https://learn.microsoft.com/en-us/exchange/architecture/client-access/availability-service-for-cross-forest-topologies?view=exchserver-2019)

We are using "Prepare-Moverequest.ps1" and ADMT to perform domain migration to migrate user from forest A to B. So users will exist in both forest A and B.

Since the autodiscover cannot be resolve to each other, do this is the cause of the problem? But the forest A and B shuld use the same smtp domain xyz.com, how to solve the problem?

Thanks

Best Regards
Chong

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2021-11-19T09:34:14.68+00:00

Hi,

Since the autodiscover cannot be resolve to each other, do this is the cause of the problem? But the forest A and B shuld use the same smtp domain xyz.com, how to solve the problem?

Yes I suppose it may cause problems. As cross-forest free/busy depends on autodiscover.

Sorry currently I don't have much thought on this issue.
I wonder if creating additional accepted domains, bind additional email address to the mailboxes in the forests and corresponding autodiscover records to point to the Exchange servers would help with this issue.

Chong 846 Reputation points

2021-11-19T09:53:39.043+00:00

Hi @Kael Yao-MSFT ,

If I creating additional accepted domains (e.g. test.com), bind additional email address to the mailboxes and DNS point to new exchange server. Anything I need to configure in exchange so the client will use this domain for autodiscover and free/busy? (such as "set-clientaccessservice –autodiscoverserviceinteraluri https://autodiscover.test.com/autodis........""

Thanks

Best Regards
Chong

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2021-11-23T08:57:40.737+00:00

Hi,

In my opinion, if the email addresses in both forests are user@xyz .com, it would be impossible for Exchange to find the corresponding autodiscover records, as Exchange would treat it as local domain.

Thus an additional email address and autodiscover record would be required, while in other words I think it also means you need additional smtp domain for Exchange to judge the actual location of the mailboxes and get the corresponding autodiscover records.

You may need to setup DNS records in public or internal DNS, and also a certificate contains the new autodiscover domain urls.

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2021-11-26T08:00:04.527+00:00

Hi @Chong

I am writing here to confirm with you how thing going now?

Chong 846 Reputation points

2021-11-26T08:13:43.93+00:00

Hi @Kael Yao-MSFT ,

Thanks for the information.

Can I just add a additional email address with another domain name and not change it to primary SMTP email address?

And do the federation trust and organization relationship is required to configure the cross-forest free/busy?

Thanks

Best Regards
Chong

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2021-11-26T09:33:12.837+00:00

Hi,

Can I just add a additional email address with another domain name and not change it to primary SMTP email address?

Yes. I think it would be possible.
If the other forest can use the extra email address to lookup for autodiscover and locate the target forest and mailbox, it should work in my opinion.

And do the federation trust and organization relationship is required to configure the cross-forest free/busy?

To my understanding, federation trust isn't necessary.
And it also requires autodiscover in public DNS.

Please refer to this link: Configure federated sharing

Chong 846 Reputation points

2021-11-29T01:58:28.17+00:00

Hi @Kael Yao-MSFT ,

I want to clarify the federation trust and organization relationship is not required in exchange free/busy? As it also require a TXT proof record in public DNS so I want to know do it require or not.

https://learn.microsoft.com/en-us/exchange/configuring-federated-sharing-between-exchange-organizations-exchange-2013-help

https://learn.microsoft.com/en-us/exchange/configure-federated-sharing-exchange-2013-help

Thanks

Best Regards
Chong

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2021-11-30T06:28:33.977+00:00

Hi,

Yes. It is not required.
As according to this link, if configured correctly, you don't need to create a federated sharing.
Sign in to comment