Exchange Online Certificate Based Authentication

Hey guys!


Today I want to build upon the last post surrounding Intune and certificate services. Once we get the certificates onto the devices the next step is to configure our services to accept certs as a form of authentication. 

I want to talk about configuring Exchange Online in this post and some caveats when setting that up. 

Per usual I dont want to spell out a guide for everyone. Those can be found in a multitude of places. There is a good one here.

https://blogs.technet.microsoft.com/messagingblogs/2017/02/16/certificate-based-authentication-o365/

What I do want to talk about are some of the gaps that this guide didnt cover. 

First thing is the intermediary. In a best practice PKI deployment you should have a Root and an Int certificate. I would publish both certificates and CRLs to Azure AD using the guide above. When you deploy the Int cert be sure you change the powershell from this

Get-AzureADTrustedCertificateAuthority

$Cert=Get-Content -Encoding byte "Location of Root CA CER file"

$New_CA=New-Object -TypeName Microsoft.Open.AzureAD.Model.CertificateAuthorityInformation

$New_CA.AuthorityType=0

$New_CA.TrustedCertificate=$Cert

$New_CA.crlDistributionPoint="CRL Distribution URL"

New-AzureADTrustedCertificateAuthority -CertificateAuthorityInformation $New_CA


To this "$New_CA.AuthorityType=1" this will specify the cert we upload as the Int.

I reccomend putting the Int cert on the devices we deploy as well as accepting it for authentication in AzureAD

The next little gotcha they don't mention is that ADFS certificate based auth goes over a different port. It goes over port 49443 so make sure you aren't blocking that port coming into the WAPS.

And last but not least make sure that you configure ADFS to accept cert based auth. In ADFS 2016 its a little checkbox under authentication types.

Migration Endpoint Auth Failures

Hello again everyone. 

Just want to talk about a little gotcha that might occur during your migrations.

You on premise migration endpoint requires on premise credentials to access the environment. I recently changed my admin credentials in my lab and started running into this error when trying to move some mailboxes.




Real descriptive Microsoft. Thanks for that, what would we do without you.

In all seriousness you can receive a more detailed error by using powershell as seen below.



You have to specify an endpoint as you can see. If you do not know your endpoint name you can just do a get-migrationendpoint.

Now that you know you have an auth problem you can fix this by going into the Exchange Online EAC then navigate to Recipients on the left hand side > Migration tab across the top > then the ellipses (the ... button).

Once there you can double click on the endpoint and in the next window you should see a field that says Associated Administrator. Right next to it, very sneakily placed, is the blue Update link we want.



Once we choose that a field to update the username and password will appear and we can enter known good credentials. 

Hope this helps someone find what they are looking for sooner!

Thanks again everyone.

Exchange Online OWA Redirection

Been awhile! 

In this post I want to talk about Exchange Online and OWA redirection for user who have a mailbox still on premise.

When you set up your hybrid environemt the wizard will automatically set your on premise TargetOwaURL to https://outlook.com/owa/domainname. You can see this by doing a get-organizationrelationship | FL in the shell.



This is the link that a user who has been moved from on premise Exchange into Exchange Online sees when they try to access their mailbox through the on premise OWA url.



This may not be set by default in your tenant. If you do a
get-organizationrelationship | FL 
in Exchange Online you may see a blank value. This is where you can add your onprem OWA url if you see fit so users who are onprem and try to access the cloud OWA will be redirected.

There is a catch though. If the on prem user IS NOT licensed for exchange online in the cloud then this redirect URL will not show up, they will only receive the " :-( Something Went Wrong" screen. See below for examples.



VS



So even if you have a few fully onprem users and wish to use this feature you are still going to have to pay the piper for a license.