MS Teams & pre-Exchange 2016CU3

Posted on April 30, 2020 by Michel de Rooij

Updated May 9th: Added Share to Teams. to table

With the emergency to facilitate working from home due to the Corona pandemic, many organizations were faced with a dilemma. When running Exchange 2013 or some even Exchange 2010 on-premises, and a desire to start using Microsoft Teams, organizations were confronted with the following requirements for integrating Microsoft Teams with Exchange on-premises (source):

Users with mailboxes hosted on-premises must be synchronized to Azure Active Directory.
Running Exchange 2016 Cumulative Update 3 or later on-premises.
OAuth needs to be configured (via Hybrid Configuration Wizard, or manual as MVP fellow Jaap blogged about here).
Recently, an additional requirement was added to explain that for delegates to schedule calendar meetings on behalf of another person, some additional steps are required (steps 2-3 mentioned here).

Now as you might know, Exchange 2010 does not support OAuth authentication. But, by putting Exchange 2016 in front of Exchange 2010, Exchange 2016 can be used for dealing with OAuth authentication, as well as dealing with client traffic as it can down-level proxy to Exchange 2010 for mailboxes hosted on those servers. Looking at these requirements, organizations might conclude that putting Exchange 2016 CU3 in front of their Exchange environment, and configuring OAuth would suffice the requirement to integrate Teams with their Exchange on-premises environment.

Alas, the additional requirement for full Teams integration is that the mailbox server hosting the mailbox should support REST API. Teams leverages Graph REST API calls to interact with mailboxes. In an Hybrid Exchange setup, on-premises mailboxes are identified, and related REST API calls will be directed at the on-premises REST endpoint, landing on your Exchange environment. The requirement for REST API support is something which is not explicitly stated in the Teams integration article, despite my earlier pull request.

It is however stated implicitly in an article on REST support in Hybrid Exchange or the original publication on REST API support in Exchange 2016 CU3 by the Exchange PG, two articles which you might easily have missed or forgotten about. Either way, it states that “All on-premises mailboxes that will use the REST APIs must be located on databases located on Exchange 2016 CU3 servers”.

Thus, with Graph API support only being available per Exchange 2016 CU3, Teams will not fully integrate with mailboxes hosted on earlier versions of Exchange. Exchange 2016 can be used to offload OAuth when your mailbox is still on Exchange 2010 (which works fine for Exchange Web Services for Free/Busy, for example), but Exchange 2010 does not support REST API, and thus will never understand those ‘weird’ requests landing on /api virtual directory, typical of REST API calls, and you will see AutodiscoverV2 and REST API calls greeted with a 404:

2020-04-29 20:22:52 fd86:b628:2775:1:9502:cdcc:d4b1:5950 GET /autodiscover/autodiscover.json Email=chefke%40contoso.com&Protocol=REST&RedirectCount=1 443 CONTOSO\EX2$ fd86:b628:2775:1:9f8:2d9:c8a1:3c4a SkypeSpaces/1.0a$*+ 404 0 2 31

Typically, first thing users usually will notice missing is the Calendar integration:

Knowing this, the assumption could be that this combination doesn’t work at all, but as often the truth lies somewhere in the middle. You can use Teams when mailboxes are still hosted on pre-Exchange 2016 CU3, if you can live with the limitations. Below I have included a short overview of these, or other noteworthy items. The information is complementary to the How Exchange and Teams interact article. I hope it may help in discussions on what works and what doesn’t.

Disclaimer: Validated with mailbox hosted on Exchange 2010 with Exchange 2016 in front, OAuth and SkypeOnline AppId configured, and using Outlook 2016 C2R. Information may be subject to change. The list may not be conclusive; if you have any additional observations, please leave them in the comments.

Actions	Works	Comment
Create & View Meetings in Teams	No	No Calendar integration as this requires Outlook Calendar REST API. Visual clue is absence of the Calendar button.
Modify User Photo in Teams (client)	No	Doesn’t work when mailbox is hosted in Exchange on-premises.
Call History	Yes	History doesn’t propagate to mailboxes hosted in Exchange on-premises in ‘Teams Calls’ folder. Does
Access Outlook Contacts	No	Works only with Exchange Online mailboxes.
Voicemail	Yes	May use & receive voice-mail, but can’t play from Teams.
Free/Busy status	Yes	Uses EWS.
Create & View/Update Teams Meetings from Outlook	Yes	Using default Teams Meeting add-in.
Create Teams Meetings from Outlook as Delegate	No	Teams Scheduler uses AutodiscoverV2 to discover delegate EWS endpoint, and fails. Outlook will display “Sorry, but we can’t connect to the server right now. Please try again later.”
View/Update Teams Meetings from Outlook as Delegate	Yes	EWS is used to fetch and update the calendar item.
MailTips in Teams	No	MailTips like Out of Office are not shown in Teams. MailTips work for Exchange 2016 CU3+.
Create & View Channel Meetings in Teams	No	Doesn’t work when mailbox is hosted in Exchange on-premises.
Share to Teams	No	Doesn’t work when mailbox is hosted in Exchange on-premises.

Of course, the better experience is to be had when your mailbox is hosted on Exchange 2016 CU3 or later (including Exchange 2019), or best when you simply host them in Exchange Online. However, given the circumstances and pressure from the organization to use Teams, that route might not be an option for everyone. Organizations may look at substantial investments in time and resources. In those cases, it might be good to know of alternative less preferable scenarios, and more important, any possible limitations you might encounter when taking a shortcut.

Exchange Updates – March 2020

Posted on March 17, 2020 by Michel de Rooij

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Like the previous Cumulative Updates, these require .NET Framework 4.8. Apart from fixes as well as security updates included from the previous CU, these update contain the following changes for Exchange 2019 CU5:

Updated Exchange calculator (v10.4).
Fixes an issue with Manage-MetaCacheDatabase.ps1 to configure MCDB.
Fixes partial word searches when using Outlook in online mode.

Links to the updates as well as a description of changes and fixes are described below.

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU5	15.2.595.3	KB4537677	VLSC		N
Exchange 2016 CU16	15.1.1979.3	KB4537678	Download	UMLP	N

Exchange 2019 CU5 fixes:

4552472 Exchange Server 2019 Sizing Calculator version 10.4 is available
4536552 Export-ModernPublicFolderStatistics.ps1 is not working in Exchange Server 2019
4538303 Exchange 2019 Setup Prerequisite Check fails for .NET 4.8 Framework in CU4 on Windows builds 1909 and 1903
4547705 Authentication loop between msft.sts.microsoft.com/adfs and OWA in Exchange Server 2019
4547706 Birthday isn’t correctly synced to iOS native mail app in Exchange Server 2019
4547708 Elevation of privileges possible when Active Directory permissions role is granted in Exchange Server 2019
4547709 InternetWebProxyBypassList is ignored by Mailbox Replication service in Exchange Server 2019
4547710 New-MailboxSearch with In-Place Hold enabled replaces all values in msExchUserHoldPolicies if adding a value in Exchange Server 2019
4547711 Public folder permissions aren’t applied from Outlook in Exchange Server 2019 hybrid environment
4547712 Outlook on the web (OWA) exposes junk operations even if disabled via OwaMailboxPolicy in Exchange Server 2019
4547713 IsOnlineMeeting is always false for Teams-only meetings in Exchange Server 2019
4547714 Can’t add remote shared mailbox using ECP into distribution group in Exchange Server 2019 hybrid environment
4547715 New created search folder retention policy is changed in Exchange Server 2019
4547719 MCDB status is “Offline” and SSDs are not formatted in Exchange Server 2019
4547720 Partial word searches not working for mailboxes in Outlook online mode in Exchange Server 2019
4547721 Exchange Sizing Calculator still supports mail.que database over 2 TB in Exchange Server 2019
4547722 Can’t go from Office 365 to Enterprise in Exchange Server 2019 Exchange admin center (EAC) if Chrome SameSite Cookie is enabled
4547723 Can’t sign in to Office 365 if configuring hybrid with Chrome SameSite Cookie enabled in Exchange Server 2019
4536987 Description of the security update for Microsoft Exchange Server 2019: February 11, 2020

Exchange 2016 CU16 fixes:

4547705 Authentication loop between msft.sts.microsoft.com/adfs and OWA in Exchange Server 2016
4547706 Birthday isn’t correctly synced to iOS native mail app in Exchange Server 2016
4547708 Elevation of privileges possible when Active Directory permissions role is granted in Exchange Server 2016
4547709 InternetWebProxyBypassList is ignored by Mailbox Replication service in Exchange Server 2016
4547710 New-MailboxSearch with In-Place Hold enabled replaces all values in msExchUserHoldPolicies if adding a value in Exchange Server 2016
4547711 Public folder permissions aren’t applied from Outlook in Exchange Server 2016 hybrid environment
4547712 Outlook on the web (OWA) exposes junk operations even if disabled via OwaMailboxPolicy in Exchange Server 2016
4547713 IsOnlineMeeting is always false for Teams-only meetings in Exchange Server 2016
4547714 Can’t add remote shared mailbox by using ECP into distribution group in Exchange Server 2016 hybrid environment
4547715 New created search folder retention policy is changed in Exchange Server 2016
4547722 Can’t go from Office 365 to Enterprise in Exchange Server 2016 Exchange admin center (EAC) if Chrome SameSite Cookie is enabled
4547723 Can’t sign in to Office 365 if configuring hybrid with Chrome SameSite Cookie enabled in Exchange Server 2016
4547716 Event ID 1325 and Test-ExchangeSearch crashes application pool with NullReferenceException in Exchange Server 2016
4536987 Description of the security update for Microsoft Exchange Server 2016: February 11, 2020

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Security Updates Exchange 2010-2019

Posted on February 13, 2020 by Michel de Rooij

A quick blog on recently published security updates for Exchange Server 2013 up to Exchange Server 2019 and Exchange Server 2010 as well. These fixes address the following vulnerabilities:

CVE-2020-0692: Microsoft Exchange Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could gain the same rights as any other user of the Exchange server. This could allow the attacker to perform activities such as accessing the mailboxes of other users. Exploitation of this vulnerability requires Exchange Web Services (EWS) to be enabled and in use in an affected environment. To exploit the vulnerability, an attacker would need to change parameters in the Security Access Token and forward it to a Microsoft Exchange Server, thereby allowing impersonation of another Exchange user. To address this vulnerability, Microsoft has changed the way EWS handles these tokens.
This vulnerability does not apply to Exchange 2010.

CVE-2020-0688: Microsoft Exchange Memory Corruption Vulnerability

A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM. The security update addresses the vulnerability by correcting how Microsoft Exchange creates the keys during install.

The CVE documents contain more details on the vulnerabilities. In addition, KB4536989 (Rollup 30) for Exchange 2010 and KB4536988 for Exchange 2013 also fixes the following issue:

KB4540267 MSExchangeDelivery.exe or EdgeTransport.exe crashes in Exchange Server 2013 and Exchange Server 2010

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

Exchange	Download	Build	KB	Supersedes
Exchange 2019 CU4	Download	15.2.529.8	KB4536987	KB4523171
Exchange 2019 CU3	Download	15.2.464.11	KB4536987	KB4523171
Exchange 2016 CU15	Download	15.1.1913.7	KB4536987	KB4523171
Exchange 2016 CU14	Download	15.1.1847.7	KB4536987	KB4523171
Exchange 2013 CU23	Download	15.0.1497.6	KB4536988	KB4523171
Exchange 2010 SP3 RU30			KB4536989	KB4509410

Be advised that the Security Updates for Exchange 2013-2019 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CUs, and you cannot apply the update for Exchange 2016 CU15 to Exchange 2016 CU14. I would suggest tagging the Cumulative Update in the file name used, e.g. Exchange2016-CU15-KB4536987-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Exchange Updates – December 2019

Posted on December 17, 2019 by Michel de Rooij

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. One significant change with these updates is the requirement for .NET Framework 4.8, as announced earlier. Also, Exchange 2019 CU4 comes with an updated Exchange calculator. Links to the updates as well as a description of changes and fixes are described below.

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU4	15.2.529.5	KB4522149	VLSC		N
Exchange 2016 CU15	15.1.1913.5	KB4522150	Download	UMLP	N

Exchange 2019 CU4 fixes:

4528696 Exchange PowerShell cmdlets take longer time to run in Exchange Server 2019
4528695 Event ID 4009 when using SubjectOrBodyMatchesPatterns on Edge server in Exchange Server 2019
4528694 Can’t open .ics file in Outlook on the web in Exchange Server 2019
4528692 “A parameter was specified that isn’t valid” error when creating transport rule in Exchange Server 2019
4523519 Set-SendConnector doesn’t work for Exchange Server in hybrid scenarios with Edge Server installed
4528688 Only one recipient shows when saving draft by using Exchange ActiveSync version 16.0 in Exchange Server 2019
4528693 Get-CalendarDiagnosticLog is proxied for queries within the same forest in Exchange Server 2019
4528687 NotificationClient logs aren’t purged and consume lots of disk in Exchange Server 2019
4528689 Outlook on the web shows MailTip when recipients equal the large audience size in Exchange Server 2019
4528690 Can’t move or delete folder in Outlook online mode if the destination has a folder with the same name in Exchange Server 2019
4532744 System.ArgumentNullException when you use Set-user to assign block legacy auth policy in Exchange Server 2019
4532747 Address list separation not working for a user without a mailbox in Exchange Server 2019
4523171 Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: November 12, 2019

Exchange 2016 CU15 fixes:

4515256 “The function cannot be performed…” error when you send a message that’s open for a long time in Exchange Server 2016
4528693 Get-CalendarDiagnosticLog is proxied for queries within the same forest in Exchange Server 2016
4523519 Set-SendConnector doesn’t work for Exchange Server in hybrid scenarios with Edge Server installed
4528690 Can’t move or delete folder in Outlook online mode if the destination has a folder with the same name in Exchange Server 2016
4528687 NotificationClient logs aren’t purged and consume lots of disk in Exchange Server 2016
4528689 Outlook on the web shows MailTip when recipients equal the large audience size in Exchange Server 2016
4528688 Only one recipient shows when saving draft by using Exchange ActiveSync version 16.0 in Exchange Server 2016
4528695 Event ID 4009 when using SubjectOrBodyMatchesPatterns on Edge server in Exchange Server 2016
4528694 Can’t open .ics file in Outlook on the web in Exchange Server 2016
4528692 “A parameter was specified that isn’t valid” error when creating transport rule in Exchange Server 2016
4515257 Hash mismatch is reported for Exchange DLLs in the bin directory of Exchange Server 2016
4528696 Exchange PowerShell cmdlets take longer time to run in Exchange Server 2016
4532747 Address list separation not working for a user without a mailbox in Exchange Server 2016
4523171 Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: November 12, 2019

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

Blocking Self-Service Purchases

Posted on November 19, 2019 by Michel de Rooij

On October 23rd, Microsoft announced – a little out of the blue – they were going to introduce self-service purchase options for users on November 19th. The details of this change were put forward in a post in the message center, article MC193609 to be exact. In short, this option would introduce the following changes for commercial tenants:

Allow end users to purchase Power Platform related subscriptions using their own payment method, e.g. Power Apps, Automate (formerly Flow) or PowerBI Pro.
These subscriptions could be made in their employee’s tenant, with the exception of government, non-profit and education.
It would not end with Power Platform subscriptions.
To make purchases, end users would be able to open a restricted view of the Microsoft 365 Admin Center.

While a handful individuals cheered ‘Power to the end user’, the vast majority of organizations were very unhappy with this development to say the least. This adoption booster would not only be opposing Microsoft’s own ‘Cloud on your terms’ and ‘Your tenant, your data’ principles they have been telling customers for years, it could also severely impact enterprise security and governance policies (or absence thereof), let alone lead to discussions when people expense their PowerBI Pro purchase. And I’m not even talking about the absence of admin controls.

So, swiftly after the massive backlash on social media, UserVoice as well as other channels, the announcement was altered, and a FAQ was published, which you can read here. The change itself was postponed until January 14th, 2020, and organizations would be handed controls to turn self-service purchases off before roll out.

Rather quietly, details on how to disable self-service purchase have been added to the FAQ. To read on how to accomplish this, continue reading my original blog post over at ENow by clicking here.

Security Updates Exchange 2013-2019

Posted on November 13, 2019 by Michel de Rooij

Exchange2019Logo A quick blog on recently published security updates for Exchange Server 2013 up to Exchange Server 2019. These fixes address the following vulnerabilities:

CVE-2019-1373: Microsoft Exchange Remote Code Execution Vulnerability

The CVE documents contain more details on the vulnerabilities. The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

Exchange	Download	Build	KB	Supersedes
Exchange 2019 CU3	Download	15.2.464.7	KB4523171	KB4515832
Exchange 2019 CU2	Download	15.2.397.9	KB4523171	KB4515832
Exchange 2016 CU14	Download	15.1.1847.5	KB4523171	KB4515832
Exchange 2016 CU13	Download	15.1.1779.7	KB4523171	KB4515832
Exchange 2013 CU23	Download	15.0.1497.4	KB4523171	KB4509409

Be advised that the Security Updates for Exchange 2013-2019 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CUs, and you cannot apply the update for Exchange 2016 CU14 to Exchange 2016 CU13. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-CU14-KB4523171-x64-en.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Ignite 2019: Exchange & Related Sessions

Posted on November 4, 2019 by Michel de Rooij

ignite2019 Note: If you are looking for the script to download Ignite contents, you can find it at the TechNet Gallery or Github.

It shouldn’t be a surprise to you, but this is the week of Ignite 2019 in Orlando, where Microsoft and other speakers will not only tell you about the latest and greatest, and how to implement recent products and use their technologies, but also draw more of the roadmap of things to come. Unfortunately, I won’t be attending Ignite (again), but similar to last year Microsoft will be live streaming keynotes, breakouts as well as theater sessions. So, you can watch stuff as it happens in the comfort of your own home or on-demand at a later time.

To access the catalog, including live streams, you can of course dive in the 1981 sessions located on the Ignite portal. Details on sessions, speakers etc. as well as filtering options are already present to help you pick what to watch, and recorded media will be added as it becomes available, including slidedecks.

For your convenience, I made a short list of sessions on Exchange Server, related technologies such as Outlook Mobile but also Teams and Groups, as well as some potentially interesting IT Pros sessions on Graph:

Session	When	Title	Speakers
BRK2296	11/4/2019 2:15 PM	Communication in Microsoft 365: Outlook and Teams integration opportunities	Brandon Haist
THR2269	11/4/2019 3:00 PM	Using Microsoft Teams: What’s new and how to get started	Aya Tange, Jeremy Chapman
THR3039	11/4/2019 3:25 PM	What’s new in the Office Customization Tool	Chris Hopkins
BRK3095	11/4/2019 4:30 PM	Understanding the importance of collaboration in modern work and the role O365 plays to unlock your team?s productivity	Ronald Pessner, Patrick Gan, Dan Costenaro, Megan Dohnal
BRK2056	11/4/2019 4:30 PM	Embrace Office 365 Groups: What’s new and what’s next	Mike McLean, Venkat Ayyadevara
BRK2001	11/4/2019 4:30 PM	What’s amazing and new in calendaring in Outlook	Julia Foran
THR3084	11/4/2019 5:45 PM	Microsoft 365 admin: Ask us anything	Aaron Woo, Ben Appleby, Alice Appleton, Tim Heeney, Karissa Larson, Yeonsoo Kim
THR1131	11/4/2019 6:20 PM	The solution to intranet adoption…Microsoft Teams	Daniel Diefendorf
BRK3013	11/5/2019 9:00 AM	Modern Exchange IT admin experiences	Rahul Gupta, Eddie Savage
BRK1079	11/5/2019 10:15 AM	Five hybrid cloud backup and disaster recovery mistakes to avoid	Douglas Ko, Shawn Gifford, Carl Holzhauer, Julian Simpson
BRK3140	11/5/2019 10:15 AM	Notes from the field: Successfully steering the government to Office 365	Michael Van Horenbeeck
BRK3012	11/5/2019 10:15 AM	Exchange hybrid: Advanced scenarios, roadmap, and real-world stories!	Andy Ryan, William Holmes
THR2016	11/5/2019 10:20 AM	Outlook for Windows: What’s new and what’s next	David Gorelik
THR3082	11/5/2019 10:55 AM	Protect against phishing and other cyberthreats with Microsoft 365 Business	David Bjurman-Birr
THR3083	11/5/2019 12:40 PM	Office 365 Groups: Ask us anything	Mike McLean, Venkat Ayyadevara, Kolvekar Loveleen Ramachandra, Nivedita Rajani, Salil Kakkar, Arunkumaran Varadharajan
THR2252	11/5/2019 1:50 PM	How Microsoft manages its own employee Office 365 tenancy	David Haam, David Johnson, Darren Moffatt
ADM50	11/5/2019 2:00 PM	Managing across tenant boundaries in Office 365	Steve Silverberg, Robert Lowe
BRK2003	11/6/2019 9:00 AM	Get ahead with Outlook mobile: Intelligent technology that helps you stay on top of your day	Tali Roth, Michael Palermiti
MLS1035	11/6/2019 9:15 AM	Microsoft Graph 101 for developers and IT professionals	Yina Arenas, Jeremy Thake
THR3003	11/6/2019 10:55 AM	New, fast, and reliable Exchange Online PowerShell cmdlets	Tony Redmond
BRK3311	11/6/2019 11:30 AM	Outlook mobile: The gold standard for secure communications in the enterprise	Ross Smith, Lexi Torres
BRK2005	11/6/2019 12:45 PM	Outlook for Mac – re-invented!	Vivek Kumar, Alessio Roic
THR2270	11/6/2019 1:50 PM	Microsoft Teams for IT admins: What’s new and what you need to know with Anne Michels	Anne Michels, Jeremy Chapman
THR2007	11/7/2019 9:00 AM	Stop organizing your own meetings ? Let Scheduler do it for you	Warren Johnson
BRK3264	11/7/2019 10:15 AM	Transform collaboration and fight shadow IT with Office 365 groups	Arunkumaran Varadharajan, Sahil Arora
THR3033	11/7/2019 11:30 AM	Reading SMTP headers like a boss	Jeff Guillet
BRK2059	11/7/2019 11:30 AM	Data residency with Office 365 datacenters	Brian Day, Adriana Wood
THR2217	11/7/2019 12:05 PM	Email is the easy part: Five pitfalls to avoid in tenant-to-tenant migrations	Paul Robichaux
BRK3144	11/7/2019 1:00 PM	The MVP guide to Office 365 security, Exchange Online edition	Theresa Miller
BRK3142	11/7/2019 2:15 PM	Things you never knew about Microsoft Teams that might be important some day	Tony Redmond
BRK3312	11/7/2019 3:15 PM	Office 365 email enhancements that makes your organization smart, safe, and secure	Leena Sheth, Kevin Shaughnessy
BRK2104	11/7/2019 3:15 PM	Your users are under attack! Strengthen your anti-phishing defense with these O365 ATP best practices	Girish Chander
BRK2058	11/8/2019 9:00 AM	Deploy Office 365 groups at scale to power Microsoft Teams, Outlook, Yammer, and SharePoint	Salil Kakkar, Martina Grom
BRK2002	11/8/2019 9:00 AM	There is a new Outlook on the web: See what’s new, fresh, and exciting	David Meyers
BRK2090	11/8/2019 9:15 AM	Will Microsoft Teams take over from email?	Tony Redmond
BRK3248	11/8/2019 10:15 AM	Securing Exchange Online from modern threats	Brandon Koeller
BRK3257	11/8/2019 10:30 AM	Leverage the cloud to strengthen your on-premises Active Directory security	Charity Shelbourne, Mark Morowczynski
THR3034	11/8/2019 12:05 PM	Twenty minutes to a secure environment	Jeff Guillet

Note that the table above was constructed using the Get-EventSession script. I’ll be closely monitoring things this week to try to make sure it can retrieve Ignite contents as it gets published and cope with any changes in publishing as happened in recent years during the event.

Exchange Updates – Sep. 2019

Posted on September 17, 2019 by Michel de Rooij

Exchange2019Logo Today, the Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. The fixes in each release, product downloads are described below:

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU3	15.2.464.5	KB4514141	VLSC		N
Exchange 2016 CU14	15.1.1847.3	KB4514140	Download	UMLP	N

Exchange 2019 CU3 fixes:

4515257 Hash mismatch is reported for Exchange DLLs in the bin directory of Exchange Server 2019
4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2019 and 2016
4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2019 and 2016
4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2019 and 2016
4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2019 and 2016
4515269 SentToMemberOf shows every recipient type not distribution groups when you create transport rule in Exchange Server 2019 and 2016
4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2019 and 2016
4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2019 and 2016
4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2019 and 2016
4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2019 and 2016
4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2019 and 2016
4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2019 and 2016
4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2019 and 2016
4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2019 and 2016
4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2019 and 2016
4515273 Mailbox auditing fails when using SHA1Managed in Exchange Server 2019 and 2016
4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2019 and 2016
4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2019 and 2016
4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Exchange 2016 CU14 fixes:

4515255 “X-InnerException: Microsoft.Mapi.MapiExceptionRpcServerTooBusy” error when you try to use a mailbox in Exchange Server 2016
4515254 Event 1009 frequently occurs in application logs for lagged database copies in Exchange Server 2016
4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2016
4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2016
4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2016
4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2016
4515269 SentToMemberOf shows every recipient type not distribution groups when creating transport rule in Exchange Server 2016
4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2016
4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2016
4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2016
4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2016
4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2016
4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2016
4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2016
4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2016
4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2016
4515273 Mailbox auditing fails when you use SHA1Managed in Exchange Server 2016
4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2016
4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2016
4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

Security Updates Exchange 2016 & 2019 (Sep2019)

Posted on September 13, 2019 by Michel de Rooij

Today, Microsoft published security fixes for Exchange Server 2016 and 2019. These fixes address the following vulnerabilities:

CVE-2019-1233: Microsoft Exchange Denial of Service Vulnerability
CVE-2019-1266: Microsoft Exchange Spoofing Vulnerability

The CVE documents contain more details on the vulnerabilities. These exploits can be fixed by single security updates; you can download them here:

Version	Links	Build	KB
2019 CU2	Download	15.2.397.6	KB4515832
2019 CU1	Download	15.2.330.10	KB4515832
2016 CU13	Download	15.1.1779.5	KB4515832
2016 CU12	Download	15.1.1713.9	KB4515832

Note: KB4515832 supersedes KB4509409 and KB4509408.

Be advised that these Security Updates are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the same update for Exchange 2016 CU13 to Exchange 2016 CU12. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-KB4515832-x64-en_CU11.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Teams Mobile & Account Switching

Posted on August 3, 2019 by Michel de Rooij

Update: Added note about Intune App Protection policies.

One of the most requested features for Microsoft Teams on UserVoice is the ability to switch accounts. When you are working in consulting like me, chances are you need to switch accounts very often. This means you need to log in and out of every account to interact with their or guest access teams. Meanwhile your company might also be sending you messages, so you have to log in there as well. Now, on desktops one can leverage browsers’ private mode to accomplish simultaneous logons, but for mobile clients such alternative does not exist. All in all, this situation is far from ideal.

Now, the mobile workforce can rejoice, as iOS and Android received a client update (1.0.8.0 on iOS, don’t have Android device at hand currently). The updated client allows them to add more than one account, and quickly (and I mean quickly) switch between these accounts and guest accounts.

To add an account, open the menu (), open Settings and select Add account at the bottom to add an existing account to your configuration.

After you finish adding accounts, you can switch between accounts by opening the menu, and selecting one of the accounts or guest access which are shown at the bottom, grouped with the account they belong to. Example is shown right (yes, this is dark mode).

To remove an account, activate the account (by selecting it or one guest access), open the menu, and select Settings and Sign Out.

Another benefit is when your tenant is Azure Information Protection enabled. After logging in, you get prompted and need to restart the Teams app. That annoyance doesn’t happen when switching accounts, as the app remains logged in when switching.

Note that at the moment, badges are only updated within the same account and guest access.

Note that you cannot configure more than one account which has Intune App Protection configured. If you already have an IAP-enabled account and another gets IAP enabled, Teams requires you to pick one of the IAP accounts to be removed from the Teams app configuration.