Exchange 2016 ECP not working

Thank you.

Get-OrganizationConfig | FL *A  --> This looks ok. It has all the URL's listed.

Also, I have copied the cert to Trusted store which is available at ADFS Server

Get-AdfsCertificate -CertificateType Token-Signing | Select-Object Thumbprint

Same error- /owa/auth/errorfe.aspx?msg=WrongAudienceUriOrBadSigningCert

Hi @Phalle, Mahesh
Thank you for your responding.

Since you have confirmed that the URIs in Get-OrganizationConfig cmdlet look correct and the certificate has been imported, but did not mention whether the thumbprint was checked or updated, that’s likely the missing piece, especially if a certificate rollover occurred recently. ADFS typically auto-rolls over certificates annually, promoting the secondary certificate to primary and generating a new secondary. If the thumbprint in the configuration wasn’t updated to reflect this change, it could be causing the issue.

If possible, could you try following these steps:

Verify your current thumbprints:

On the ADFS Server  

To list all token-signing certificates and identify the current primary certificate:

Get-AdfsCertificate -CertificateType Token-Signing | Select Thumbprint, IsPrimary 

Look for the certificate where IsPrimary is $true. This is the active certificate after a rollover.

You may also see a secondary certificate (IsPrimary is $false), which is still valid during the rollover period.

On the Exchange Server  

Check the thumbprints currently configured in Exchange:

Get-OrganizationConfig | Select -ExpandProperty AdfsSignCertificateThumbprint

If the output only shows the old thumbprint or doesn’t match the primary from ADFS, that’s likely the issue.

Update the Thumbprint in Exchange

To add the new primary thumbprint (recommended post-rollover to avoid breaking existing sessions):

Set-OrganizationConfig -AdfsSignCertificateThumbprint @{Add="<NewPrimaryThumbprintFromADFS>"} 

Replace <NewPrimaryThumbprintFromADFS> with the actual thumbprint (no spaces, case-insensitive).

To also add the secondary certificate (optional but helpful for future rollovers):

Set-OrganizationConfig -AdfsSignCertificateThumbprint @{Add="<SecondaryThumbprintFromADFS>"}

If you prefer to replace all existing thumbprints with just the new primary (only if the old cert is expired or no longer needed):

Set-OrganizationConfig -AdfsSignCertificateThumbprint "<NewPrimaryThumbprintFromADFS>

Restart IIS on All Exchange Servers

After updating the configuration, restart IIS to apply the changes:

iisreset /noforce

You can refer more via: Exchange 2016 ECP and OWA unavailable after ADFS token certificate rollover - Collaboration - Spice…

Note: Microsoft is providing this information as a convenience to you. These sites are not controlled by Microsoft, and Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please ensure that you fully understand the risks before using any suggestions from the above link. 

Any update would be appreciated. 

Hi @Phalle, Mahesh

I wanted to check if the solution I shared earlier worked for you. 

If you need any clarification or further help, feel free to reach out. 
Looking forward to hearing from you.

I am running Get-OrgConfig and it cannot find this property in Exchange Server 2016

unning

Actually, Thumbprint wasn't added before under OrgConfig so I have added that now and IIS Reset was done. I am still getting same issue. Do you know if this certificate needs to be on all exchange servers?

Hi @Phalle, Mahesh

Regarding your question: 

1.What will be the impact in hybrid deployment if set this value to false? 

Setting AdfsAuthentication to $false on the ECP (and ideally OWA) virtual directories disables ADFS as the authentication provider for those interfaces. As a result, access to ECP and OWA will no longer redirect users to ADFS for claims-based authentication (including MFA). Instead, it will fall back to legacy authentication methods such as Forms, Basic, or Windows Integrated Authentication, depending on what is configured via Set-EcpVirtualDirectory or Set-OwaVirtualDirectory. This change might lead to several impacts: 

Security and Authentication Downgrade: 

Users lose SSO and MFA via ADFS and must log in separately. Might fall back to basic authentication, increasing vulnerability to brute-force attacks. 

If Hybrid Modern Authentication (HMA) is enabled, disabling ADFS could break modern auth flows. 

Hybrid Functionality: 

Core hybrid features (such as calendar sharing, mailbox moves) remain unaffected as they rely on organization-level OAuth. However, admin tasks in ECP involving hybrid management may face authentication issues if ADFS is the identity provider. 

User and Client Experience: 

Outlook clients may revert to basic auth, losing MFA/SSO. Mobile apps (for example, Outlook for iOS/Android) could be affected if they rely on modern auth. 

2.If not, what else we can check in ADFS? 

If keeping AdfsAuthentication as True, you could focus on ADFS-side validation, as the issue often ties to token mismatches post-MFA. Run these on your ADFS server(s): 

Relying Party Trusts Configuration:  

Open AD FS Management console > Relying Party Trusts > Select the Exchange trusts 

Ensure URIs match exactly with Exchange's AdfsAudienceUris (from Get-OrganizationConfig | Select -ExpandProperty AdfsAudienceUris), including case, slashes. Mismatches could cause "WrongAudienceUri" issue. Edit to align if needed. Then, confirm SAML/WS-Trust endpoints point correctly. 

Certificate and Rollover Checks:  

Re-check primary/secondary certs:

Get-AdfsCertificate -CertificateType Token-Signing | Select Thumbprint, IsPrimary

If rollover occurred, ensure both thumbprints are in Exchange OrgConfig:

Set-OrganizationConfig -AdfsSignCertificateThumbprint @{Add="<Thumbprint>"}

Remove expired/old certs from Exchange trusted stores to avoid conflicts. 

Farm and Sync Issues:  

If ADFS farm (primary/secondary), verify sync:

Get-AdfsSyncProperties

If the primary node changed, update thumbprints and restart the ADFS service.

Enable IdP-initiated sign-on page if needed:

Set-AdfsProperties -EnableIdPInitiatedSignonPage $true

After primary switch, update thumbprints and restart ADFS service. 

Event Logs and Diagnostics:  

Check ADFS Admin logs (Event Viewer > Applications and Services > AD FS > Admin) for issues during login (for example, audience URI mismatches or cert failures). 

Enable ADFS tracing:

wevtutil sl "AD FS Tracing/Debug" /e:true

Reproduce the issue and review the logs. 

Use Fiddler or browser dev tools to inspect SAML tokens and validate audience URIs. 

After changes, run iisreset /noforce on Exchange servers and test. If HMA is enabled, check OAuth config:

Get-AuthConfig

Renew if expired.

I hope this helps.