KB ID 0001548
Note: Applies to Exchange 2019, 2016, and 2013.
This is pretty much PART TWO, of presenting ‘Exchange Web Services’ using Web Application Proxy. Back in PART ONE we looked at publishing OWA and ECP, and that required having an ADFS server. To present the other web services, e.g Outlook Anywhere, Exchange Active Sync, Offline address book etc. You don’t need ADFS, you simply use ‘pass through‘ authentication with your WAP Server, directly to Exchange.
Before you start, you need to make sure in addition to the DNS records we used for OWA and ECP, you also need to be able to publicly resolve your Autodiscover record. I prefer doing this with public SRV records, see the following article for clarification;
Creating an AutoDiscover SRV Record
You now need, to make sure that the URLs that Exchange uses for it’s web services are set correctly, to do that use the following PowerShell commands;
Get-OutlookAnywhere |select InternalHostname,ExternalHostname Get-OABVirtualDirectory |select InternalUrl,ExternalUrl Get-ActiveSyncVirtualDirectory |select InternalUrl,ExternalUrl Get-WebServicesVirtualDirectory |select InternalUrl,ExternalUrl Get-MapiVirtualDirectory |select InternalUrl,ExternalUrl Get-ClientAccessService |select AutoDiscoverServiceInternalUri
Make sure your internal URLS are resolvable inside and your external/public URL’s are resolvable outside, (To the public IP address of your WAP Server).
Exchange URLS To Publish with WAP
As with the URLs we published previously remember to publish them with a trailing ‘slash’. You need to publish and ‘Reverse Proxy‘ the following URLs;
Outlook Anywhere: https://mail.ubique.com/rpc/
Offline Address Book: https://mail.ubique.com/oab/
Exchange Web Services: https://mail.ubique.com/EWS/
Note: Obviously your domain will have a different name!
Publish Outlook Anywhere with WAP
From the ‘Remote Access Management Console’ > Publish > Next.
Give the Published rule a sensible name like “Outlook Anywhere” > Enter the URL’s, and select your public certificate > Next.
Publish Active Sync with WAP
Active Sync is required for phones and mobile devices that cannot use Outlook Anywhere. To publish this rule repeat the procedure above, but at the Publishing Setting page use the following settings.
Publish Offline Address Book with WAP
Offline Address Book is required by devices to download a cached copy of the global address list. To publish this rule repeat the procedure above, but at the Publishing Setting page use the following settings.
Publish Exchange Web Services with WAP
Exchange Web Services allow clients to access calendars, contacts and scheduling information remotely. To publish this rule repeat the procedure above, but at the Publishing Setting page use the following settings.
Publish Exchange MAPI with WAP
Mail Application Programming Interface (over HTTPS) if the default connection protocol in modern Exchange deployments. To publish this rule repeat the procedure above, but at the Publishing Setting page use the following settings.
Publish Exchange Web Services with WAP
If you’ve used Exchange since version 2007, you will know how important Autodiscover is, (probably because of the headaches caused when it’s not setup correctly!) To publish this rule repeat the procedure above, but at the Publishing Setting page use the following settings.
Final Sanity Check
When complete, your WAP settings should look like this, (this is for all the pass-through, AND ADFS published settings).
Once setup correctly, Outlook should work fine externally, like so;
Related Articles, References, Credits, or External Links
it seems that WAP for services like active synch, owa doesn’t work without configuring adfs… so it will not replace reveser proxy for exchange with arr, right?
OWA will work without ADFS. Outlook Anywhere will work at the moment, but it will probably stop working with an upcoming update.
Great article 🙂
You have a question mark in “OWA will work without ADFS?” so what do you mean by that?
At the beginning you wrote: “Back in PART ONE we looked at publishing OWA and ECP, and that required having an ADFS server.”
So I guess the final result is, that OWA and ECP require ADFS?
Also, do you mean that Outlook Anywhere works without ADFS at the moment, but in the future might require ADFS?
OWA will work without ADFS
ECP will work without ADFS
Outlook anywhere will ‘currently’ work without ADFS but when Microsoft enforce modern authentication on you it will ‘stop working’ without warning, when the update is applied. (No I don’t know when that will be).
Where’s the part one i used search box but i only found part two only
Click the words PART ONE? 🙂
Hi, Thanks for the great demonstration i finished the publishing with exchange 2019 and wap 2019, i can access the owa from outside and the login page appears without any issues but once i logging it took about 10 min and showing message (still working on it) is very slow
I’ve faced the same problem. Moreover Outlook was not able to connect to exchange at all.
Solved with ms support by setting on WAP servers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\
Entry name: EnableDefaultHttp2
This applies to win2019 and win2022
Exchange Active Sync (EAS) can be published with (pre-authentication) “ADFS for Rich Clients” while using ADFS 4.0
No need to publish it in “Passtrough” anymore.
Can MAPIHTTP be published with (pre-Authenticaiton) with ADFS through ADFS?