Connect Exchange Online to Dynamics 365 Customer Engagement (on-premises) | Microsoft Learn

If you get the below error while testing a mailbox , make SURE You use the App Service Account ( E.g. ‘Network Service’ ) with CertificateReconfiguration.ps1 –

How to Setup Dynamics 365 Server-Side Synchronization for On-Premise to Exchange Online – Hitachi Solutions

Message from 365::

Acquiring Token from ACS has failed. Please check if your tenantId is specified correctly in your Email Server Profile, and make sure your Exchange and CRM are under the same tenant

Request to Exchange::

<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:53:17Z">
Starting SCP lookup for domainName='[REDACTED]', root path=''
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:53:18Z">
Searching for SCP entries in LDAP://CN=Configuration,DC=[REDACTED]
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:53:18Z">
Scanning for SCP pointers Domain=[REDACTED]
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:53:18Z">
No SCP pointers found for 'Domain=[REDACTED]' in configPath='CN=Configuration,DC=[REDACTED]'
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:53:18Z">
Determining which endpoints are enabled for host [REDACTED]
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:53:45Z">
Request error: Unable to connect to the remote server
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:53:45Z">
No Autodiscover endpoints are available for host [REDACTED]
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:53:45Z">
Determining which endpoints are enabled for host [REDACTED]
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:54:14Z">
Request error: Unable to connect to the remote server
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:54:14Z">
No Autodiscover endpoints are available for host [REDACTED]
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:54:14Z">
Trying to get Autodiscover redirection URL from http://[REDACTED]/autodiscover/autodiscover.xml.
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:54:14Z">
Redirection URL found: 'https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml'
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:54:14Z">
Determining which endpoints are enabled for host autodiscover-s.outlook.com
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:54:14Z">
Request error: The remote server returned an error: (401) Unauthorized.
</trace>
<trace tag="AutodiscoverConfiguration" tid="63" time="2025-07-30 04:54:14Z">
Host returned enabled endpoint flags: Legacy, Soap, WsSecurity, WSSecuritySymmetricKey, WSSecurityX509Cert, OAuth
</trace>
<trace tag="AutodiscoverRequestHttpHeaders" tid="63" time="2025-07-30 04:54:14Z">
POST /autodiscover/autodiscover.svc HTTP/1.1
Content-Type: text/xml; charset=utf-8
Accept: text/xml
User-Agent: CRM/9.0.0.0/OnPremise (ExchangeServicesClient/15.0.1076.7)
client-request-id: [REDACTED]
return-client-request-id: true
</trace>
<trace tag="AutodiscoverRequest" tid="63" time="2025-07-30 04:54:14Z" version="15.0.1076.7">
<!--?xml version="1.0" encoding="utf-8"?-->
<soap:envelope xmlns:a="http://schemas.microsoft.com/exchange/2010/Autodiscover" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:header>
<a:requestedserverversion>Exchange2013</a:requestedserverversion>
<wsa:action>http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetUserSettings</wsa:action>
<wsa:to>https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc</wsa:to>
</soap:header>
<soap:body>
<a:getusersettingsrequestmessage xmlns:a="http://schemas.microsoft.com/exchange/2010/Autodiscover">
<a:request>
<a:users>
<a:user>
<a:mailbox>[REDACTED]</a:mailbox>
</a:user>
</a:users>
<a:requestedsettings>
<a:setting>ExternalEwsUrl</a:setting>
<a:setting>InternalEwsUrl</a:setting>
</a:requestedsettings>
</a:request>
</a:getusersettingsrequestmessage>
</soap:body>
</soap:envelope>
</trace>

Response from Exchange:

Microsoft.Exchange.WebServices.Data.ServiceRequestException: The request failed. The request was aborted: The request was canceled. ---> System.Net.WebException: The request was aborted: The request was canceled. ---> Microsoft.Crm.CrmException: Access token could not be obtained from: https://accounts.accesscontrol.windows.net/tokens/OAuth/2 for resource: [REDACTED] ---> Microsoft.Crm.CrmException: Certificate: [REDACTED] with FindType: FindBySubjectDistinguishedName was not found in Store: My at StoreLocation: LocalMachine.
at Microsoft.Crm.Authentication.Claims.CertificateUtility.RetrieveICertificate(CertificateData certificateData)
at Microsoft.Crm.Authentication.Claims.CertificateUtility.GetICertificate(String certificateType)
at Microsoft.Crm.Authentication.Claims.CertificateUtility.GetCertificate(String certificateType)
at Microsoft.Crm.Authentication.S2S.CrmClientServicePrincipal.get_SigningCredentials()
at Microsoft.Crm.Authentication.S2S.AuthorizationServerIssuedOAuthCredentials.GetSignedAccessTokenData(ServicePrincipal issuerPrincipal, WebRequest request)
--- End of inner exception stack trace ---
at Microsoft.Crm.Authentication.S2S.AuthorizationServerIssuedOAuthCredentials.GetSignedAccessTokenData(ServicePrincipal issuerPrincipal, WebRequest request)
at Microsoft.Crm.Authentication.S2S.AccessTokenCache.AccessTokenFactory.GetAccessToken(GetNewAccessTokenDelegate getNewAccessTokenDelegate, ITraceListener traceListener)
at Microsoft.Crm.Authentication.S2S.AuthorizationServerIssuedOAuthCredentials.GetAccessToken(ServicePrincipal issuerPrincipal, WebRequest request)
at Microsoft.Crm.Authentication.S2S.OAuthCredentials.AuthenticateInternal(ServicePrincipal issuerPrincipal, WebRequest request)
at Microsoft.Crm.Authentication.S2S.OAuthCredentials.PreAuthenticate(WebRequest request)
at System.Net.AuthenticationManagerDefault.Authenticate(String challenge, WebRequest request, ICredentials credentials)
at System.Net.AuthenticationState.AttemptAuthenticate(HttpWebRequest httpWebRequest, ICredentials authInfo)
at System.Net.HttpWebRequest.CheckResubmitForAuth()
at System.Net.HttpWebRequest.CheckResubmit(Exception& e, Boolean& disableUpload)
at System.Net.HttpWebRequest.DoSubmitRequestProcessing(Exception& exception)
at System.Net.HttpWebRequest.ProcessResponse()
at System.Net.HttpWebRequest.SetResponse(CoreResponseData coreResponseData)
--- End of inner exception stack trace ---
at System.Net.HttpWebRequest.GetResponse()
at Microsoft.Exchange.WebServices.Data.EwsHttpWebRequest.Microsoft.Exchange.WebServices.Data.IEwsHttpWebRequest.GetResponse()
at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverRequest.InternalExecute()
--- End of inner exception stack trace ---
at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverRequest.InternalExecute()
at Microsoft.Exchange.WebServices.Autodiscover.GetUserSettingsRequest.Execute()
at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.InternalGetUserSettings(List1 smtpAddresses, List1 settings, Nullable1 requestedVersion, Uri& autodiscoverUrl)    at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.GetSettings[TGetSettingsResponseCollection,TSettingName](List1 identities, List1 settings, Nullable1 requestedVersion, GetSettingsMethod2 getSettingsMethod, Func1 getDomainMethod)
at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.GetUserSettings(List1 smtpAddresses, List1 settings)
at Microsoft.Exchange.WebServices.Autodiscover.AutodiscoverService.InternalGetSoapUserSettings(String smtpAddress, List`1 requestedSettings)
at Microsoft.Crm.Asynchronous.EmailConnector.ExchangeConnectivityDiscoverer.DiscoverUserSettingsInternal()