<div> 
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2526 " id="quads-ad2526" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 <h2>The Story</h2><p>A good and detailed documentation is everything we need to implement any kind of project especially if it&rsquo;s an integration between two different servers that perform different roles.</p><div> 
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2527 " id="quads-ad2527" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 </div><div> 
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2531 " id="quads-ad2531" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 </div><div> 
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2524 " id="quads-ad2524" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 </div><p>And with PKI involved the complications multiply thus a good article write up is what we need.</p><p>Previously I have tried a test lab with Skype for Business 2015/2019 IM Integration with Exchange 2016/2019 and the result was a complete failure and endless search for what&rsquo;s missing to get IM to work from OWA?</p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb.png" alt="image" width="403" height="494" border="0"></a> 
</p><div> 
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2523 " id="quads-ad2523" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 </div><h2>ERROR</h2><p>Upon completion of the steps mentioned in Microsoft&rsquo;s Official documentation and after restarting Exchange IIS or OWAAppPool you will see this when you try to login to OWA with your user</p><blockquote><p>There&rsquo;s a problem with instant messaging. Please try again later.</p></blockquote><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-1.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-1.png" alt="image" width="264" height="374" border="0"></a></p><h2>MS Official Documentation</h2><p>In their Official documentation Microsoft says that the certificate in question must be trusted by all the servers involved meaning Skype for Business Frontend and Mailbox Servers.</p><p>Meanwhile this is true, it still would not get the IM to login/work although it might drop the initialize event ID 112 in the event log.</p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/clip_image001.png"><img style="margin: 0px; display: inline; background-image: none;" title="clip_image001" src="https://www.moh10ly.com/wp-content/uploads/2020/06/clip_image001_thumb.png" alt="clip_image001" width="1028" height="281" border="0"></a></p><h4>Here is what MS says about the certificate.</h4><p>Exchange and Skype for Business integration requires server certificates that are trusted by all of the servers involved. The procedures in this topic assume that you already have the required certificates. For more information, see <a href="https://docs.microsoft.com/skypeforbusiness/plan-your-deployment/integrate-with-exchange/integrate-with-exchange">Plan to integrate Skype for Business Server 2015 and Exchange</a>. The required IM certificate thumbprint refers to the Exchange Server certificate assigned to the <strong>IIS service.</strong></p><p>REF URL: <a title="https://docs.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-im-integration-with-owa?view=exchserver-2019#what-do-you-need-to-know-before-you-begin" href="https://docs.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-im-integration-with-owa?view=exchserver-2019#what-do-you-need-to-know-before-you-begin">https://docs.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-im-integration-with-owa?view=exchserver-2019#what-do-you-need-to-know-before-you-begin</a></p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-2.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-2.png" alt="image" width="1028" height="250" border="0"></a></p><h2>Step by Step Deployment</h2><p>To do things the way that should get this to work, I will detail steps one by one so we can be sure to get the positive results we are all waiting for when dealing with Exchange and Skype for Business.</p><p><strong>Exchange IM URL</strong> <sup>1</sup>: mail.domain.com</p><p><strong>Skype for Business Pool FQDN</strong>: SBG-Pool01.domain.com</p><p><strong>Autodiscover URL</strong> : Autodiscover.Domain.com</p><h2>Prerequisites</h2><ol>
<li>For Default and Web Service Internal, Your Skype for Business Frontend Server/Pool must use a certificate that is generated from an internal CA which you can use later to generate Exchange&rsquo;s IM Certificate.</li>
<li>UCMA must be installed (Doesn&rsquo;t matter if version 4 or 5) both are supposed to work with Exchange 2016.</li>
<li>Local Certification Authority must already be deployed in the domain.</li>
</ol><h2>Configuration Steps &ndash; Part 1</h2><ol>
<li>On SfB: Set CsAuthConfiguration Autodiscover URL for Skype server to find Exchange Autodiscover</li>
<li>On SfB: Get-CsSite to see what is the current site ID.</li>
<li>On Exchange: Check AutodiscoverServiceInternalURI</li>
<li>On SfB: Create new Partner</li>
<li>On SfB: Create new Trusted Application Pool</li>
<li>On SfB: Create new Trusted Application ID</li>
</ol><h2><a href="https://www.moh10ly.com/skype-for-business-im-integration-with-exchange-2016-owa-part-2/">Configuration Steps &ndash; Part 2</a></h2><p>7. On Exchange: Enable OWA VD Instant Messaging<br>
8. On Exchange: Enable Messaging on OWA Policy<br>
9. On Exchange: Create Enterprise Application for Skype Pool.<br>
10. On Exchange: Create new SettingOverride for Skype for Business.<br>
11- Generate a new Certificate for Exchange IM<br>
12. Assign the newly imported certificate to IIS Exchange Back End site<br>
13. On Exchange: Restart the WebAppPool<br>
14. Log out and sign back in to OWA to Check<br>
15. Troubleshooting methods</p><h2>Prerequisites</h2><h2>1- Update or Create Server Default and Web Service Internal Certificate for SfB Pool servers</h2><p>The certificate installed on the Skype for Business Pool Frontend servers must be generated from a local Certification Authority which can be trusted by Exchange Server services.</p><p>The Certificate generated for Skype for Business pool as in the below screenshot is generated from my CA and includes the names of the servers:</p><ul>
<li>Skype for Business Pool</li>
<li>Skype for Business Frontend FQDNs</li>
<li>Exchange Servers</li>
<li>Autodiscover FQDN</li>
<li>Lyncdiscover.domains.com</li>
<li>Lyncdiscoverinternal.domains.com</li>
<li>sip.domains.com</li>
<li>meet.domains.com</li>
<li>dialin.domain.com</li>
<li>External.domain.com</li>
</ul><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-3.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-3.png" alt="image" width="361" height="479" border="0"></a></p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-4.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-4.png" alt="image" width="661" height="286" border="0"></a></p><h2>2- UCMA must be installed</h2><p>On both Exchange and Skype for Business servers I already have UCMA 4.0 version installed, but if you don&rsquo;t have it or have an older version then you can&rsquo;t continue without it.</p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-5.png"><img style="display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-5.png" alt="image" width="802" height="84" border="0"></a></p><h2>3- Make sure you have a Local Certification Authority deployed in your domain.</h2><h2>Configuration Steps &ndash; Part 1</h2><h2>1- On SfB: Set CsAuthConfiguration Autodiscover URL for Skype server to find Exchange Autodiscover</h2><p>For Skype for Business Server to find Exchange Autodiscover Service point and to be able to authenticate servers we&rsquo;ll be using the below cmdlet</p><p>This enables both servers to authenticate and share information when needed and without user&rsquo;s interference.</p><p>Set-CsOauthConfiguration -ExchangeAutodiscoverUrl <a href="https://autodiscover.domain.com/autodiscover/autodiscover.svc">https://autodiscover.domain.com/autodiscover/autodiscover.svc</a></p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-6.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-6.png" alt="image" width="1028" height="61" border="0"></a></p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-7.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-7.png" alt="image" width="1028" height="171" border="0"></a></p><p>Ref:</p><p><a href="https://docs.microsoft.com/en-us/powershell/module/skype/set-csoauthconfiguration?view=skype-ps">https://docs.microsoft.com/en-us/powershell/module/skype/set-csoauthconfiguration?view=skype-ps</a></p><h2>2- On SfB: Get-CsSite to see what is the current site ID.</h2><p>Getting a site ID will be useful for later use to setup the Trusted Application Pool.</p><p>On Skype for Business Management shell. Type the following</p><p>Get-CsSite</p><p>So the Site ID is 1. I will keep this for later use</p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-8.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-8.png" alt="image" width="1028" height="91" border="0"></a></p><h2>3- On Exchange: Check AutodiscoverServiceInternalURI</h2><p>Specify the AutodiscoverServiceInternalURI for internal Autodiscover service. Make sure it points to your public URL and certificate not the internal one otherwise your users will get a certificate error through Outlook and might cause IM chat not to work.</p><p>The Cmdlet would be</p><p>Get-ClientAccessService | Set-ClientAccessService &ndash;AutoDiscoverServiceInternalUri <a href="https://autodiscover.domain.com/autodiscover/autodiscover.xml">https://autodiscover.domain.com/autodiscover/autodiscover.xml</a></p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-9.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-9.png" alt="image" width="1028" height="91" border="0"></a></p><h2>4- On SfB: Create new Partner Application</h2><p>On Skype for Business Server, Launch Management Shell and use this cmdlet to add Exchange as a trusted Application to the SfB topology.</p><p>New-CsPartnerApplication -Identity Exchange -ApplicationTrustLevel Full -MetadataUrl &ldquo;<a href="https://autodiscover.domain.com/autodiscover/metadata/json/1">https://autodiscover.domain.com/autodiscover/metadata/json/1</a>&rdquo;</p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-10.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-10.png" alt="image" width="1028" height="182" border="0"></a></p><h2>5- On SfB: Create new Trusted Application Pool</h2><p>New-CsTrustedApplicationPool -Identity mail.domain.com -Registrar sbg-pool01.domain.com -Site 1 -RequiresReplication $false</p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-11.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-11.png" alt="image" width="1028" height="406" border="0"></a></p><h2>6- On SfB: Create new Trusted Application ID</h2><p>From SfB Management Shell run the following cmdlet .</p><p>New-CsTrustedApplication -ApplicationId OutlookWebAccess -TrustedApplicationPoolFqdn mail.domain.com -Port 5199</p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/image-12.png"><img style="margin: 0px; display: inline; background-image: none;" title="image" src="https://www.moh10ly.com/wp-content/uploads/2020/06/image_thumb-12.png" alt="image" width="1028" height="167" border="0"></a></p><p>Finally</p><p><a href="https://www.moh10ly.com/wp-content/uploads/2020/06/clip_image0014.png"><img style="margin: 0px; display: inline; background-image: none;" title="clip_image001[4]" src="https://www.moh10ly.com/wp-content/uploads/2020/06/clip_image0014_thumb.png" alt="clip_image001[4]" width="343" height="70" border="0"></a></p><p>Click on the link below for Part 2</p><blockquote class="wp-embedded-content" data-secret="D3CT9kC81n"><p><a href="https://www.moh10ly.com/skype-for-business-im-integration-with-exchange-2016-owa-part-2/">Skype for Business IM integration with Exchange 2016 OWA&ndash;Part 2</a></p><div> 
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2529 " id="quads-ad2529" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 </div></blockquote><p><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; visibility: hidden;" title="&ldquo;Skype for Business IM integration with Exchange 2016 OWA&ndash;Part 2&rdquo; &mdash; Welcome to Mohammed Hamada's Site" src="https://www.moh10ly.com/skype-for-business-im-integration-with-exchange-2016-owa-part-2/embed/#?secret=kNvriZOpkv#?secret=D3CT9kC81n" data-secret="D3CT9kC81n" width="600" height="338" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe></p></div>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2530 " id="quads-ad2530" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>


Reset and manage your Active Directory users' Passwords Active Directory is one of the most…
Finding Exchange Database hidden mailboxes. Story:Maybe you have been in this situation before, trying to…
If you're using a Proxy server in your firewall or in your network and have…
Story:I got some clients that have reported some of their users being locked out and…
Delegate Permissions This is a code that I have wrote recently to check if an…
Story: I got a request from a client who constantly gets CVs and have to…
View Comments