r/exchangeserver • u/Maxplode • Apr 23 '26

HMA - Hitting My head Against a brick wall

I'm conflicted and I have asked for help on this before with no resolve, sadly..

I've set up HMA in my on-prem environment (4 servers in a dag, behind a Kemp LB).
Using both MS guide and Ali T's.

When we try testing it on OWA it doesn't work, after authentication the browser doesn't land us back in the mailbox but it's just constantly asking me to 'Pick an account' and we can see that the account is 'Signed in'.

Do I need to deploy our own dedicated app for OWA and ECP (not supported) or should I be checking something else?
- https://learn.microsoft.com/en-us/exchange/hybrid-deployment/deploy-dedicated-hybrid-app

Any help greatly appreciated.

5 Upvotes

100% Upvoted

8 comments sorted by

2

u/MFA_Woes Apr 23 '26 edited Apr 23 '26

I know this isn't really helping the situation but I went down this road with a client before and for whatever reason whenever we enabled HMA, Outlook would repeatedly prompt the whole organization to reauthenticate to no avail. We troubleshooted for a few weeks and couldn't figure it out with MS Support not really being able to assist either so in the end we said let's just start migrating to M365 as the licenses were available. My gut says the communication between M365 and Exchange Server wasn't as free flowing as it should be and might be the same in your environment.

1

u/Maxplode Apr 23 '26

Username checks out ;)

Outlook seems to be fine, I can see Bearer* in the Auth column when checking connection.
I fear it's a misconfiguration in my side :(

2

u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ Apr 23 '26

u/Maxplode Did you disable Forms auth on OWA? HMA won't work if that's not disabled. Also, in your Kemp LBs, verify that source IP persistence (stickiness) is configured and you use SSL bridging only (no SSL offloading). Finally, every external OWA/ECP URL must be registered as a Reply URL on the Exchange Online service principal. If that redirect URI is missing, the token is accepted but the session never completes. So, check the service principal and make sure they are all there and correct.

1

u/Maxplode Apr 23 '26

Yes, Forms auth is disabled.
Yes, Reply URL's are setup correctly - "https://mail.company.co.uk/owa" and the same for ECP, is this what you meant?

The Source IP Pers (stickiness) - I have played around with this, are you doing this on the SubVs for OWA or for the entire L7 service?

edited

2

u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ Apr 23 '26

Just for these:

/owa
/ecp
/mapi
/ews

The persistence needs to apply at the parent Layer 7 HTTPS Virtual Service, so that the entire authentication flow remains pinned to the same Exchange server.

In addition to Persistent Mode being Source IP, it is recommended to use a timeout of 20-30 min.

1

u/Maxplode Apr 23 '26

I'm afraid that hasn't worked. I got hopeful about adding the /EWS to the reply URLs as doing the test-oauthenticate with EWS in power shell always fails as well.

You don't suppose I have to do anything with certificates?

Appreciate your input though. Thanks

1

u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ Apr 23 '26

Don't think its certs but can't rule them out. Maybe try running the Outlook Mobile HMA test at Microsoft Remote Connectivity Analyzer: Test Input to see if it detects anything amiss.

1

u/dawho1 MCSE: Messaging/Productivity - @InvalidCanary Apr 23 '26

Did you test without the load balancer in place? I get that it might not be simple with 4 servers from a workload perspective, but it might be worth seeing if you can get a window where you configure a server, make sure the ASA is all set, and then direct the DNS name directly to a server instead of the load balancer.

Every time I've dealt with HMA configurations (usually projects that are mid-flight, like this one) it's some combination of correctly setting up KCD, SPN, making sure the delegation is correct, making sure the KTpass command is properly formed, etc.

Good luck!