Exchange publishes Autodiscover addresses in Active Directory and in DNS. Domain-joined Outlook clients get the address from a service connection point. Set-ClientAccessService sets the internal Autodiscover address on Exchange 2016, 2019 and Subscription Edition. Microsoft shows no fix for a server name that returns without its domain. Older Exchange 2013 steps need a separate Microsoft source.
Outlook connects to Exchange only after Autodiscover returns a usable address. Autodiscover fails when it returns a server name without its domain. It also fails when the name does not match the certificate. Administrators then see certificate warnings or failed profile setup.
Facts follow the Microsoft Learn pages Autodiscover in Exchange Server and Set-ClientAccessService. Its scope is Exchange 2016, 2019 and Subscription Edition. Older Exchange 2013 steps come from other Microsoft sources.
How does Outlook Find the Autodiscover Address?
- Service connection point. Domain-joined clients ask Active Directory for SCP objects. Every object stores an address like https://cas01/autodiscover/autodiscover.xml in its ServiceBindingInfo attribute.
- Direct HTTPS. Clients outside the domain try the primary SMTP domain, like https://autodiscover.contoso.com/autodiscover/autodiscover.xml.
- Redirect. Microsoft lists https://autodiscover.contoso.com/autodiscover/autodiscover.xml as the redirect URL.
- DNS SRV record. Clients look for an _autodiscover._tcp record.
Microsoft lists these four methods and states no strict order for them. Exchange creates the SCP object when it creates the autodiscover virtual directory during installation.
Why does a Short Server Name Cause Problems?
SCP addresses built from a short server name like cas01 contain no domain. Certificates carry full names. Microsoft states that the name in a DNS record must match a name in the certificate. Mismatches produce a warning while the service remains reachable.
Microsoft does not describe the exact error from the older Exchange 2013 post. Linking a short SCP name to the certificate warning is an inference from these statements.
How to Set the Internal Autodiscover URL?
Set-ClientAccessService updates the SCP address. Microsoft describes the AutoDiscoverServiceInternalUri parameter as the internal URL of the Autodiscover service. Use a full name that exists in the certificate.
Set-ClientAccessService -Identity "MBX-01" -AutoDiscoverServiceInternalUri "https://mbx01.contoso.com/autodiscover/autodiscover.xml" -AutoDiscoverSiteScope "Mail"AutoDiscoverSiteScope names the Active Directory site that the service is authoritative for. Clients that use the internal URL must exist in that site. Get-ADSite lists the available sites.
What DNS Records does Autodiscover Need?
- CNAME. Microsoft recommends an autodiscover CNAME in external DNS that points to the external name of the Mailbox server, like mail.contoso.com. Create one for every domain on the account.
- SRV. This alternative record uses service _autodiscover, protocol _tcp, port 443 and the host mail.contoso.com.
- Full names. Some DNS providers need the full name. For contoso.com enter autodiscover.contoso.com.
How to Test Autodiscover?
Microsoft recommends the Remote Connectivity Analyzer. Its Outlook Autodiscover test and Exchange ActiveSync Autodiscover test show where the lookup fails. When Autodiscover passes and Outlook still fails, check the external URLs for OAB, EWS, MAPI and Outlook Anywhere.
What does Microsoft Not Say?
Microsoft pages never mention the Exchange 2013 cmdlet Set-ClientAccessServer. It also does not describe the local XML redirect from older posts. Exchange 2013 administrators need the Exchange 2013 documentation from Microsoft for those steps.
Related reading: how to fix Exchange SMTP error 550 5.7.1 and Exchange Server disaster recovery plan.
Frequently Asked Questions
Where does Outlook Get the Autodiscover Address?
Domain-joined clients look it up in SCP objects in Active Directory. Other clients try the primary SMTP domain, a redirect and a DNS SRV record.
Which Cmdlet Sets the Internal Autodiscover URL?
Set-ClientAccessService with parameter AutoDiscoverServiceInternalUri. Microsoft documents it for Exchange 2016, 2019 and Subscription Edition.
Does a Certificate Mismatch Stop Autodiscover?
No. Microsoft states that a mismatch causes a warning and the service remains reachable.
Is a New Certificate Needed?
Microsoft does not say so. It states that the DNS name must match a name in the certificate.
How do You Test Autodiscover?
Use the Microsoft Remote Connectivity Analyzer and its Outlook Autodiscover test.
Key Takeaways
- Exchange stores Autodiscover addresses in SCP objects and DNS records.
- Set-ClientAccessService sets the internal address in Exchange 2016 and later.
- DNS names in Autodiscover records must match a name in the certificate.
- Mismatches give a warning and the service remains reachable.
- Microsoft gives no Exchange 2013 steps on the pages used here.
Sources and References
Facts follow Microsoft Learn.
- Autodiscover in Exchange Server (Microsoft Learn) learn.microsoft.com
- Set-ClientAccessService (Microsoft Learn) learn.microsoft.com