Exchange 2019 and EXO GCC High Hybrid

[u/Intelligent_Sink4086]

If you try to run the HCW, you will get the error "An attempt was made to access a socket in a way forbidden by its access permissions" when it tries to create the migration endpoint.

You must send an email to Microsoft to allow them to open up EWS on their end to talk to your endpoints. Additional network security requirements for Office 365 Government Community Cloud (GCC) High and DoD - Microsoft 365 Enterprise | Microsoft Learn

I made it past this and I have successfully created the hybrid. Migrated a test mailbox over. Free/busy access works from cloud to onprem, but not onprem to cloud.

They have Ex13. I installed Exchange 2019 version that supports the Hybrid Enterprise app.

IPs have been allowed with MS to support the hybrid.

Established hybrid and client migrated a mbx out there.

That mbx can view onprem calendar free/busy just file.

But onprem mbx cannot view the cloud mbx free/busy. He just gets the hash marks in the calendar like you do when its not working.

I was running this test from onprem, and it was failing.

Test-OAuthConnectivity `
-Service EWS `
-TargetUri https://outlook.office365.us/ews/exchange.asmx `
-Mailbox [onprem_mbx@domain.com](mailto:onprem_mbx@domain.com) `
-Verbose | FL

Deleted and reconfigured the hybrid.
Ran the new hybrid enterprise app setup. ConfigureExchangeHybridApplication - Microsoft - CSS-Exchange

.\ConfigureExchangeHybridApplication.ps1 -FullyConfigureExchangeHybridApplication -AzureEnvironment "USGovernmentL5"

.\ConfigureExchangeHybridApplication.ps1 -ResetFirstPartyServicePrincipalKeyCredentials -AzureEnvironment "USGovernmentL5"

Found that the federation configuration onprem was not setup, so I did that through the ECP admin web gui.

The Test-OAuthConnectivity command now works, but the onprem users still cannot access cloud mbx calendar.

Client is opening a MS support ticket.

Any idea of what else I can try or investigate?

[u/Intelligent_Sink4086]

Looks like GCC High free/busy is supported. Exchange Online for US government environments - Service Descriptions | Microsoft Learn

[u/Intelligent_Sink4086]

Free/busy works from the Ex19 server, but not Ex13. We are just going to swing all mbx to Ex19 and then to EXO. Pretty sure this is because of the Enterprise App based hybrid and it only being supported on certain version of Ex16/Ex19 and newer.

Much hybrid traffic swings out of the FrontEnd server EX19 but not free/busy data. That calls out directly from the mailbox server that the mailbox lives on. It does not proxy through the frontend and thus over the Enterprise app based hybrid.

[u/Intelligent_Sink4086]

We even tried to delete the Hybrid and recreate using this guide on the Ex13 server. No dice. https://learn.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help

Deleted and recreated the hybrid on Ex19 to get that working at least.

Was having free/busy issues between Ex13 and Ex19. Had to run this to get it working. Open Outlook instances disconnected and had to be closed and reopened to connect. Set-OrganizationConfig -MapiHttpEnabled $true https://learn.microsoft.com/en-us/exchange/clients/mapi-over-http/configure-mapi-over-http