Complete guide to configure multi-tenant hosting for Exchange 2007 with ISA 2006 (Part 4)

In this article, I will be showing how do we make use of ISA 2006 to achieve Autodiscover function for multi-tenant infrastructure.

What will happen if we do not do this?

The outlook 2007 users will get security prompt about the certificate on the ISA server whenever they perform an auto profile configuration and offline address book download.

This is kind of annoying and some users might not happy to see that.

So steps below will show you how to get around that.

Pre-requisition

1. The certificate that installed on ISA must from public trusted CA.

2. an additional dedicated IP address is required. This IP Address must not share with other SSL connection or tied with any other certificate.

Some overview of autodiscover feature.

Let me quote the line below from msexchangeteam.com [1]

"Outlook is hard coded to find the Autodiscover end point by looking up either https://company.com/Autodiscover/Autodiscover.xml or https://Autodiscover.company.com/Autodiscover/Autodiscover.xml (where company.com is the portion of the users SMTP address following the @ sign)" [2]

This simply explained how this feature works. In additional to this information, outlook will also try to look for the end point via non-secure protocol(http).

To understand more about it, press & hold Ctrl and right click on the outlook icon in system tray.

Click on "Test E-mail AutoConfiguration.."

Fill up a valid email address and password, check only "Use AutoDiscover" and click on "Test"

From the result output, you will have a clearer picture on how outlook finds the autodiscovery end point.

Here we use CNAME in DNS to redirect the traffic to our ISA server.

e.g autodiscover.coa.com CN autodiscover.united.com (ISA IP address)

This time I am creating a "Publish Web Site" rule

We will use the non-secure connection

It is optional to fill up the path

We need to create a new listener for autodiscover

Use a separate IP Address

There are additional configuration after create the rule.

under properties of the rule

You need to add the publish DNS name of autodiscover entry for each individual customer

Specify the "Internal Path"

Now you can give a try from outlook client and there should not have any security prompt about the certificate.

Hope you find this article is useful. Cheers.. :)