Microsoft Teams Calendar syncing with Exchange 2016/2019

With Microsoft Teams replacing Skype for Business, some integration scripts need to be run to allow your on-premises Exchange 2016 or Exchange 2019 Servers to be able to share information. If you are not familiar with the Hybrid Configuration Wizard (HCW), if you have set up a new Microsoft 365 tenant and you want to sync your on-premises information, you need to run this wizard so that your certificates are in place, connectors are set up, and you are ready to either move everything to Microsoft 365 or run in hybrid mode. One of the biggest challenges is the Calendar sync from on-premises to Microsoft 365 and having the Calendar icon show up in Microsoft Teams. Suppose your setup is wrong, or you have not done the scripts as you need to. In that case, you may end up with no Calendar showing or have a Calendar showing in Microsoft Teams with no information or giving you a nice warning that nothing is showing up yet because your administrator has not configured it.

First step: Download latest HCW

As a rule of thumb, I generally download the latest HCW because bugs in earlier versions or issues are addressed in the newer version. Microsoft does advise to run the latest HCW. Also, for Teams and Exchange 2016 or Exchange 2019 to run smoothly, you need to be running the latest Cumulative Update (CU) for that Exchange version. In this article, we will not cover the Hybrid Configuration Wizard as it is pretty straightforward to run the setup. Here are some of the key items in the HCW:

• Let the wizard select an optimal Exchange 2016 or Exchange 2019 server.
• Sign in to your Office 365 Tenant and let the wizard show no issues for on-premises and Microsoft Office 365.
• Select the SSL certificate that you will use.
• Set Autodiscover for your domain, either to $true or $false depending on your needs, and enter the domain name.
• Let the setup go and create the connectors for you to let it finish. If there are errors, you need to address them.

To be able to run some of the commands, you need to do so from your Exchange Server. Here are the first three:

New-AuthServer -Name "WindowsAzureACS" -AuthMetadataUrl "https://accounts.accesscontrol.windows.net/contoso.com/metadata/json/1"
New-AuthServer -Name "evoSTS" -Type AzureAD -AuthMetadataUrl https://login.windows.net/contoso.com/federationmetadata/2007-06/federationmetadata.xml
Get-PartnerApplication | ?{$_.ApplicationIdentifier -eq "00000002-0000-0ff1-ce00-000000000000" -and $_.Realm -eq ""} | Set-PartnerApplication -Enabled $true

Upload your certs

You must have a cert that needs to be uploaded to Azure/Office 365 Tenant for OAuth. You need to connect to your tenant here — that is what the first two lines are doing — and the reset is creating the cert for you and then creating the principal.

$Cred = Get-Credential
Connect-MSOLService -Credential $Cred
$CertFile = "$ENV:SYSTEMDRIVE\OAuthConfig\OAuthCert.cer"
$objFSO = New-Object -ComObject Scripting.FileSystemObject
$CertFile = "\\Server1\c$\OAuthConfig\OAuthCert.cer"
$CER = New-Object System.Security.Cryptography.X509Certificates.X509Certificate
$CER.Import($CertFile)
$binCert = $cer.GetRawCertData()
$CredValue = [System.Convert]::ToBase64String($binCert)
$ServiceName = "00000002-0000-0ff1-ce00-000000000000"
$P = Get-MsolServicePrincipal -ServicePrincipalName $ServiceName
New-MsolServicePrincipalCredential -AppPrincipalId $P.AppPrincipalId -Type asymmetric -Usage Verify -Value $credValue

The next step is very important: You need to ensure that the service principal names you have for Autodiscover and Outlook Web Access (OWA) are added, especially if you have multiple domains, or else you will get certificate errors.

In the same session you need to check what names you have with the following command:

Get-MsolServicePrincipal -AppPrincipalId 00000002-0000-0ff1-ce00-000000000000 | select -ExpandProperty ServicePrincipalNames

If you are missing values, you need to add what you have set in Exchange. Here are the set of commands:

$ServiceName = "00000002-0000-0ff1-ce00-000000000000";
$x = Get-MsolServicePrincipal -AppPrincipalId $ServiceName;
$x.ServicePrincipalnames.Add("https://mail.domain.com/");
$x.ServicePrincipalnames.Add("https://autodiscover.domain.com/");
Set-MSOLServicePrincipal -AppPrincipalId $ServiceName -ServicePrincipalNames $x.ServicePrincipalNames;

Now that the above is done, you need to run the Hybrid Configuration Wizard and then let it all sync. Microsoft advises it will take anything from 2-24 hours.

The next thing is licensing. You need to have a license assigned to a user in your Microsoft Office 365 Tenant. This can be a dedicated teams license or an E5 license. Once the license is assigned, it also takes time to sync.

From experiencing this with multiple clients, I noticed that the web interface updated first compared to the desktop client. The Calendar icon appeared, and once the cache was cleared while we were testing on the desktop client, the Calendar icon showed up and synced without an issue.

What I did notice was if you make any changes to Microsoft Exchange Web Services (EWS), this may impact connectivity to the Calendar and can also affect connectivity for Mac users, so just take note of this. If you restrict EWS in your organization, you need to ensure that the scheduling agent, Microsoft Teams, and Skype for Business are added to the allow list.

Once everything has synced and settled, you should be able to create Calendar items directly from Microsoft Teams, and it will sync to your Exchange on-premises Calendar and vice versa.

Microsoft Teams Calendar sync troubleshooting

For troubleshooting, you can enable logging-in settings (click the cogwheel under your name) and restart Microsoft Teams.

In macOS, you can click the Help menu and choose “collect support logs.” In Windows, you can right-click the icon in the tray and choose to get logs. For the location of the desktop logs, you can see where they are in the image below.

Featured image: Shutterstock