How to fix 401 error on exchange 2019 owa and ecp ADFS authentication

Chibwe Kapambwe 0 Reputation points
2025-10-06T18:09:09.6333333+00:00

Am trying to setup adfs authentication for owa and ecp in exchange 2019, using 2019 adfs. Both servers are running on a common local network. ADFS works fine, i have some tests using the test login page, communication with active directory is also fine. The problem i have is, owa and ecp are failing to redirect to adfs login page, i followed the official guide provided on this https://learn.microsoft.com/en-us/exchange/clients/outlook-on-the-web/ad-fs-claims-based-auth link.

I have nothing in the event viewer on both servers, anything that could give me more information on why am getting 401 error, instead of a redirect to adfs.

Exchange | Exchange Server | Other
Exchange | Exchange Server | Other

A robust email, calendaring, and collaboration platform developed by Microsoft, designed for enterprise-level communication and data management.Miscellaneous topics that do not fit into specific categories.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ceyhun KIRMIZITAS 0 Reputation points Microsoft External Staff
    2026-09-21T21:19:34.5933333+00:00

    If the AD FS settings are already correct, I would check the IIS and Exchange HTTP Proxy logs next.

    For the failed request, check the HTTP status and substatus in IIS and correlate the same timestamp with the OWA HTTP Proxy logs.

    I documented how I use these logs together for OWA authentication troubleshooting here: https://ceyhunkirmizitas.net/exchange-owa-authentication-troubleshooting-iis-logs-part-4/

    I would also use the browser F12 Network trace to confirm whether Exchange returns the redirect to AD FS or the 401 happens before that point.

    Was this answer helpful?

    0 comments
  2. Andy David - MVP 160.3K Reputation points MVP Volunteer Moderator
    2025-10-06T18:38:00.34+00:00

    I would verify the OWA and ECP virtual dirs again to ensure they include ADFS auth set to $true

    Have you restarted IIS?

    If you do a F12 in the browser and do a network trace does anything pop out?

    Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -OAuthAuthentication $false -WindowsAuthentication $false

    Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -OAuthAuthentication $false -WindowsAuthentication $false

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.