The Autodiscover service makes it easier to configure Outlook 2007. Earlier versions of Exchange and Outlook required you to configure all user profiles manually to access Microsoft Exchange. Extra work was required to manage these profiles if changes occurred to the messaging environment. Otherwise, the Outlook clients would stop functioning correctly.

The Autodiscover service uses a user's e-mail address or domain account to automatically configure a user's profile. By using the e-mail address or domain account, the Autodiscover service provides the following information to the client:

• The user’s display name
  
• Separate connection settings for internal and external connectivity
  
• The location of the user’s Mailbox server
  
• The URLs for various Outlook features that govern such functionality as free/busy information, Unified Messaging, and the offline address book
  
• Outlook Anywhere server settings
  

When a user's Microsoft Exchange information is changed, Outlook automatically reconfigures the user's profile by using the Autodiscover service. For example, if a user's mailbox is moved or the client is unable to connect to the user's mailbox or to available Exchange features, Outlook will contact the Autodiscover service and automatically update the user's profile with the information that is required to connect to the mailbox and Exchange features.

If you are providing external access to Microsoft Exchange by using Outlook Anywhere (formerly known as RPC over HTTP), and you want the Autodiscover service to automatically configure your Outlook 2007 clients, you must install a valid Secure Sockets Layer (SSL) certificate on the Client Access server that includes both the common name (for example, mail.contoso.com) and a Subject Alternative Name for autodiscover.contoso.com. For information about how to configure your SSL certificate to use a Subject Alternative Name, see 여러 개의 클라이언트 액세스 서버 호스트 이름을 사용하도록 SSL 인증서를 구성하는 방법. Additionally, you must correctly configure your Exchange services, such as the Availability service, before the Autodiscover service can provide the correct external URLs to clients.

When the client tries to connect to your Microsoft Exchange deployment, the client locates the Autodiscover service on the Internet by using the primary SMTP domain address from the user's e-mail address. Based on whether you have configured the Autodiscover service to have a separate name from your organization's existing DNS host name, the Autodiscover service URL will be either https://<smtp-address-domain>/autodiscover/autodiscover.xml or https://autodiscover.<smtp-address-domain>/autodiscover/autodiscover.xml. For example, if the user's e-mail address is monica@contoso.com, the Autodiscover service should be located at either https://contoso.com/autodiscover.xml or https://autodiscover.contoso.com/autodiscover/autodiscover.xml. This means that you must add a host record for the Autodiscover service to your external DNS zone.

For more information, see "How to Configure the Autodiscover Service for Internet Access" later in this white paper.

We recommend that you host the Autodiscover service on a separate site if you manage a Web site that is visited frequently that also hosts your e-mail traffic. The following figure illustrates an environment in which the Autodiscover service is deployed in a different Active Directory site than the Active Directory site where your Exchange servers reside.

Using multiple sites with the Autodiscover service

In the preceding figure, the Internet Security and Acceleration (ISA) Server 2006 firewall publishes two sites by using two Web listeners. The first site, autodiscover.contoso.com, provides access to the Autodiscover virtual directory on the Client Access server and is assigned to one IP address. For internal traffic on the Client Access server, configure one Web listener and publish all virtual directories on this site. The second site, mail.contoso.com, provides access to the other Exchange features and has a unique second IP address. Do not publish the Autodiscover virtual directory on this site.

For more information, see "How to Configure the Autodiscover Service for Multiple Sites" later in this white paper.

If you manage a large, distributed organization that has Active Directory sites that are separated by low-bandwidth network connectivity, we recommend that you use site affinity for the Autodiscover service for intranet-based traffic. To use site affinity, you specify which Active Directory sites are preferred for clients to connect to a particular Autodiscover service instance. Specifying which Active Directory sites are preferred is also known as configuring site scope.

You configure site affinity by using the Set-ClientAccessServer cmdlet. This cmdlet lets you specify the preferred Active Directory sites for connecting to the Autodiscover service on a specific Client Access server. After you configure site affinity for the Autodiscover service, the client will connect to the Autodiscover service as you specified.

The following example uses a topology that includes one forest with three sites:

• US-contoso   A contoso site that is located in North America
  
• Europe-contoso   A contoso site that is located in Europe
  
• APAC-contoso   A contoso site that is located in Asia
  

In this example, the Autodiscover service is enabled on each site and each site includes user mailboxes. The US-contoso site is connected to the Europe-contoso site by using a high-speed connection. The US-contoso site is connected to the APAC-contoso site by using a low-speed connection. The APAC-contoso site is connected to the Europe-contoso site by using a high-speed connection.

Based on these connectivity factors, you might want to allow users in the US-contoso and Europe-contoso sites to use either the US-contoso or the Europe-contoso site, users in Europe-contoso site to use any site to access the Autodiscover service, and users in the APAC-contoso site to use the APAC-contoso or the Europe-contoso site. Finally, the Client Access servers can be reached by using a common internal namespace across all sites.

You can configure site scope for Client Access servers in the US-contoso site by setting them to prefer to use the US-contoso and Europe-contoso Active Directory sites to access the Autodiscover service. To do this use the following command.

Set-ClientAccessServer -Identity "us-cas" -AutodiscoverServiceInternalURI "https://internal.contoso.com/autodiscover/autodiscover.xml" -AutodiscoverServiceSiteScope "us-contoso","europe-contoso"

You do not have to specify the Active Directory sites to which your users should connect to access the Autodiscover service on Client Access servers in the Europe-contoso site because it connects well to other sites. The following command enables all users in the Europe-Contoso site to access any Client Access server to use the Autodiscover service.

Set-ClientAccessServer -Identity "europe-cas" -AutodiscoverServiceInternalURI "https://internal.contoso.com/autodiscover/autodiscover.xml"

Finally, you can configure site scope for the Autodiscover service on Client Access servers in the APAC-contoso site by setting them to prefer to use the APAC-contoso and Europe-contoso sites because they connect well to these sites. To do this, use the following command.

Set-ClientAccessServer -Identity "apac-cas" -AutodiscoverServiceInternalURI "https://internal.contoso.com/autodiscover/autodiscover.xml" -AutodiscoverServiceSiteScope "apac-contoso","europe-contoso"

Therefore, if a client in the US-contoso site has a mailbox located in the Europe-contoso site and tries to locate the Autodiscover service, the client can select the service instance that has site=US-contoso or site=Europe-contoso.

If you do not specify site scope for the Autodiscover service, the client might return the autodiscoverInternalUri parameter for the APAC-contoso site because of the slow connection to the US-contoso site.

참고:
If you do not configure a specific set of Active Directory sites for clients to use, Outlook 2007 will randomly select Client Access servers to use to access the Autodiscover service.

For more information about site affinity, see "How to Configure the Autodiscover Service to Use Site Affinity" later in this white paper.

You can deploy Microsoft Exchange by using multiple forests. Two of the multiple forest deployment scenarios are the resource forest topology and the multiple trusted forest topology. The following sections describe how the Autodiscover service is used in these two deployment scenarios.

Configuring the Autodiscover Service in a Resource Forest Topology

If you are using a resource forest topology, user accounts reside in one forest (referred to as a user account forest) and Microsoft Exchange is deployed in a separate forest (referred to as a resource forest). In this scenario, the client contacts Active Directory in the user account forest to locate the URL for the Autodiscover service. Because the service is hosted in the resource forest, you must update Active Directory in the user account forest to include the information that Active Directory requires to enable the client to access the resource forest. To do this, you must create an Autodiscover SCP pointer record in Active Directory in the user account forest. The Autodiscover SCP pointer record includes the Lightweight Directory Access Protocol (LDAP) URL of the resource forest that the client will use to locate the Autodiscover service.

To create the Autodiscover SCP pointer record in the user account forest, run the Export-AutoDiscoveryConfig cmdlet from the resource forest that has the Autodiscover service against the user account forest. For more information, see "How to Configure the Autodiscover Service with Multiple Forests" later in this white paper.

Configuring the Autodiscover Service in a Multiple Trusted Forest Topology

In the multiple trusted forest scenario, the user accounts and Microsoft Exchange are deployed in multiple forests. Exchange 2007 features such as the Availability service and Unified Messaging rely on the Autodiscover service to access user accounts across forests. In this scenario, the Autodiscover service must be available to users across multiple trusted forests. This scenario resembles the resource forest scenario, except that the Autodiscover SCP object must be configured in all forests. To configure the Autodiscover SCP object in the multiple forest topology, run the Export-AutoDiscoveryConfig cmdlet from each forest that has the Autodiscover service against each target forest where Microsoft Exchange is deployed. For more information, see "How to Configure the Autodiscover Service with Multiple Forests" later in this white paper.

For hosted environments, the Autodiscover service must be redirected for each hosted domain by using Internet Information Services (IIS). The following figure illustrates the Autodiscover service in a hosted environment.

The Autodiscover service in a hosted Exchange environment

For each hosted e-mail domain, you should set up a site together with its corresponding DNS entries. For example, the domain named contoso.no should be called autodiscover.contoso.no, and the domain named example.contoso.se should be called autodiscover.contoso.se. In the site in the preceding figure, there is no need for any virtual directories and you do not have to set up SSL certificates.

In IIS Manager, configure redirection for each of your sites to https://mail.contoso.com/autodiscover/autodiscover.xml.

참고:
These sites should be configured only for HTTP (port 80) traffic.

When you configure redirection on these sites, you must use anonymous access and disable authenticated access. Also, make sure that you do not configure other options such as The exact URL entered above, A directory below URL entered, and A permanent redirection for this resource. Configuring redirection in this manner causes the Outlook 2007 client to receive an HTTP 302 response.

After you configure redirection, Outlook 2007 clients will try to connect to https://contoso.no/autodiscover/ and https://autodiscover.contoso.no/autodiscover/ by using an HTTP POST request. Because these sites are unavailable, Outlook will try an HTTP GET request to http://autodiscover.contoso.no/autodiscover.

참고:
No information, such as the user's e-mail address and password, is sent in this request.

Because redirection is configured on this site, IIS will return a 302 redirection response for https://mail.contoso.com/. The client will receive the response and prompt the user to accept or reject the request. The user must accept this request. After this occurs, the client will then be redirected by using an HTTPS POST request. In this example, there will be no security alert. Finally, the client will receive the necessary Autodiscover service response.

참고:
When you configure a redirector to redirect clients to a new site, as in the previous example, additional SSL certificates are not required. However, you must configure additional IIS sites.

If you have deployed Exchange 2007 in your messaging environment, you can let the Autodiscover service automatically configure Microsoft Office Outlook 2007 clients for Exchange features such as the Availability service, Unified Messaging, and Outlook Anywhere. If you plan to allow external access to the Autodiscover service for Outlook 2007 clients that connect from the Internet, you must configure a valid Secure Sockets Layer (SSL) certificate from a certification authority (CA) that is trusted by the client computer's operating system.

We recommend that you host the Autodiscover service on a separate site if you manage a Web site that is frequently visited and that hosts your e-mail traffic. To allow external access to the Autodiscover service for Outlook 2007 clients that are connected from the Internet, we recommend that you follow these steps in order.

참고:
You must use one IP address per site.

1. (Optional) Configure a separate site on a Client Access server to host the Autodiscover service   You can create a separate site to host Autodiscover service traffic by using the New-AutodiscoverVirtualDirectory cmdlet. This optional step is recommended if the SMTP address domain is the same as the Web site address for your organization and your organization's Web site is frequently visited. For example, if the Web site is www.contoso.com, the e-mail SMTP domain is contoso.com, and the Web site (www.contoso.com) is frequently visited, we recommend that you create a separate site and host the Autodiscover service on autodiscover.contoso.com. For more information, see 새 Autodiscover 서비스 가상 디렉터리를 만드는 방법.
   
2. (Required) Configure a valid SSL certificate   Configure a valid SSL certificate from a CA that the client computer trusts. If you have decided to host the Autodiscover service on a separate site, see 여러 개의 클라이언트 액세스 서버 호스트 이름을 사용하도록 SSL 인증서를 구성하는 방법.
   
3. (Optional) Update the SCP object   If you have created an additional IIS site for the Autodiscover service, you must update the service connection point (SCP) object in Active Directory to specify to which Client Access server and Autodiscover virtual directory you want clients to connect.
   
4. (Required) Configure Exchange services   The Exchange services such as the Availability service and the Offline Address Book (OAB) must be configured for settings such as the external host name and authentication settings. For more information, see "How to Configure Exchange Services for the Autodiscover Service" later in this white paper.
   

After you have completed these steps, you should configure the firewall for the address space and configure the SSL certificate for the Autodiscover service.

Before You Begin

To perform the following procedure, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group for the target server. 

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see 사용 권한 고려 사항.

1. If you have not already done this, create a new Web site for the Autodiscover service by using IIS Manager.

2. Create a new Autodiscover virtual directory in IIS for the Autodiscover service by running the following command:

   New-AutodiscoverVirtualDirectory -Websitename <websitename> -BasicAuthentication:$true -WindowsAuthentication:$true

   참고:
   A Web site that uses SSL requires that you use a unique IP address.

3. Configure a trusted third-party SSL certificate on the Autodiscover service Web site.

For more information about syntax and parameters, see New-AutodiscoverVirtualDirectory.

If your Exchange deployment has two or more trusted forests, you must update Active Directory so that users who are running Microsoft Office Outlook 2007 in one forest can access the Client Access servers in the remote (or target) forest to use the Autodiscover service. To do this, run the Export-AutodiscoverConfig cmdlet in each forest that contains the Client Access servers that provide the Autodiscover service against the target forests. This will configure the Autodiscover pointer service connection point (SCP) information in Active Directory.

Before You Begin

To perform the following procedure, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group for the target server.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see 사용 권한 고려 사항.

1. On an Exchange 2007 Client Access server in the source forest, obtain the user name and password for the account that has the required permissions for the target forest by running the following command:

   $a = Get-Credential

2. On an Exchange 2007 Client Access server in the source forest, run the following command:

   Export-AutoDiscoverConfig -DomainController DomainControllerName -TargetForestDomainController TargetForestDomainControllerName -TargetForestCredentials $a -MultipleExchangeDeployments $true

For more information about syntax and parameters, see Export-AutoDiscoverConfig.

You can use the Set-ClientAccessServer cmdlet in the Exchange Management Shell to configure the Autodiscover service to use site affinity on a computer that is running Exchange 2007 that has the Client Access Server role installed.

Before You Begin

To perform the following procedure, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group for the target server.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see 사용 권한 고려 사항.

• Run the following command:

  Set-ClientAccessServer -Identity "ServerName" -AutodiscoverServiceInternalURI "https://internalsitename/autodiscover/autodiscover.xml" AutodiscoverServiceSiteScope "SiteName"

For more information about syntax and parameters, see Set-ClientAccessServer.

If your Exchange deployment has two or more trusted forests, you must update Active Directory so that users who are running Microsoft Office Outlook 2007 in one forest can access the Client Access servers in the remote (or target) forest to use the Autodiscover service. To do this, run the Export-AutodiscoverConfig cmdlet in each forest that contains the Client Access servers that provide the Autodiscover service against the target forests. This will configure the Autodiscover pointer service connection point (SCP) information in Active Directory.

Before You Begin

To perform the following procedure, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group for the target server.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see 사용 권한 고려 사항.

1. On an Exchange 2007 Client Access server in the source forest, obtain the username and password for the account that has the required permissions for the target forest by running the following command:

   $a = Get-Credential

2. On an Exchange 2007 Client Access server in the source forest, run the following command:

   Export-AutoDiscoverConfig -DomainController DomainControllerName -TargetForestDomainController TargetForestDomainControllerName -TargetForestCredentials $a -MultipleExchangeDeployments $true

For more information about syntax and parameters, see Export-AutoDiscoverConfig.

You can use the Exchange Management Shell to configure your Microsoft Exchange deployment to handle mailboxes that are moved from one forest to another for the Autodiscover service.

For a cross-forest mailbox move, the two forests must be trusted. For the Autodiscover service to handle this move, you must configure a mail contact in the original forest where the user's mailbox resided.

When you configure a mail contact, the user will authenticate to the original forest where the mailbox resided, and the user will receive a redirect that uses the new e-mail address. The client will then try to contact the Autodiscover service by using the new e-mail address against the new forest.

For example, mail1.contoso.com and mail2.contoso.com are separate, trusted forests and the mailbox for a user is kwekua@mail1.contoso.com. This user originally resided in the forest named mail1.contoso.com and was moved to the forest named mail2.contoso.com.

For this example, you have to set a contact in mail1.contoso.com by using the following command in the Exchange Management Shell.

New-MailContact -ExternalEmailAddress 'SMTP:kwekua@mail2.contoso.com' -Name 'Kweku Ako Adjei' -Alias 'kwekua' -OrganizationalUnit 'mail1.contoso.com/Users' -FirstName 'Kweku' -Initials '' -LastName 'Ako Adjei'

After you configure the contact, when the user connects to mail1.contoso.com and uses the mail1.contoso.com credentials, the following request is sent to the Outlook 2007 client.

<?xml version="1.0" encoding="utf-8" ?>\r\n

<Autodiscover xmlns="http://schemas.contoso.com/exchange/autodiscover/outlook/requestschema/2006">\r\n

<Request>\r\n

<EMailAddress>kwekua@mail1.contoso.com</EMailAddress>\r\n

<AcceptableResponseSchema>http://schemas.contoso.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>\r\n

</Request>\r\n

</Autodiscover>

The Outlook 2007 client will receive the following redirect response from mail1.contoso.com.

<?xml version="1.0" encoding="utf-8"?>\r\n

<Autodiscover xmlns="http://schemas.contoso.com/exchange/autodiscover/responseschema/2006"><Response xmlns="http://schemas.contoso.com/exchange/autodiscover/outlook/responseschema/2006a">\r\n

<Account>\r\n

<Action>redirectAddr</Action>\r\n

<RedirectAddr>kwekua@mail2.contoso.com</RedirectAddr>\r\n

</Account>\r\n

</Response></Autodiscover>

The user will then be able to connect to the Autodiscover service by using this new e-mail address in the mail2.contoso.com forest.

Before You Begin

To perform the following procedure on an Exchange 2007 Client Access server, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group for the target server.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see 사용 권한 고려 사항.

• Run the following command:

  New-MailContact -ExternalEmailAddress 'SMTP:kwekua@mail2.contoso.com' -Name 'Kweku Ako Adjei' -Alias 'kwekua' -OrganizationalUnit 'mail1.contoso.com/Users' -FirstName 'Kweku' -Initials '' -LastName 'Ako Adjei'

For more information about syntax and parameters, see New-MailContact.

This section explains how to configure Microsoft Exchange services, such as the Availability service, for the Autodiscover service on a Microsoft Exchange 2007 computer that has the Client Access server role installed.

When you enable Outlook Anywhere, you must also configure external access to Microsoft Exchange services for the Autodiscover service. This includes the URLs for the Availability service, Exchange Web Services, Unified Messaging (UM), and the offline address book.

If you do not configure the external URL values, the Autodiscover service information provided to the Microsoft Office Outlook 2007 client may be incorrect for clients that are connecting from outside your network. They may be able to connect to their Microsoft Exchange mailbox. However, they will be unable to use Exchange features such as Out of Office functionality, the Availability service, Unified Messaging, or offline address book downloads.

Generally, the internal URL is configured by Microsoft Exchange Setup. However, the external URLs must be configured by using the virtual directory cmdlet for each component.

In this section, you will configure external host name, authentication, and encryption settings for the following Web services:

• Outlook Anywhere
  
• Offline address book
  
• Unified Messaging
  
• Exchange Web Services
  

If you performed a custom installation of Exchange 2007 and you will not be using an Exchange service such as Unified Messaging, you will not have to complete the procedure to configure the external URL for Unified Messaging for the Autodiscover service later in this section. Additionally, if you are not providing external access to your Exchange services, you can safely ignore these procedures.

Before You Begin

To perform the following procedures, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group for the target server. 

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see 사용 권한 고려 사항

• Run the following command:

  Enable-OutlookAnywhere -Server CAS01 -ExternalHostname "mail.contoso.com" -ExternalAuthenticationMethod "Basic" -SSLOffloading:$False

For more information about syntax and parameters, see Enable-OutlookAnywhere.

• Run the following command:

  Set-OABVirtualDirectory -identity "CAS01\OAB (Default Web Site)" -externalurl https://mail.contoso.com/OAB -RequireSSL:$true 

For more information about syntax and parameters, see Set-OABVirtualDirectory.

• Run the following command:

  Set-UMVirtualDirectory -identity "CAS01\UnifiedMessaging (Default Web Site)" -externalurl https://mail.contoso.com/UnifiedMessaging/Service.asmx  -BasicAuthentication:$True

For more information about syntax and parameters, see Set-UMVirtualDirectory.

• Run the following command:

  Set-WebServicesVirtualDirectory -identity "CAS01\EWS (Default Web Site)" -externalurl https://mail.contoso.com/EWS/Exchange.asmx -BasicAuthentication:$True

For more information about syntax and parameters, see Set-WebServicesVirtualDirectory.