Configure Exchange 2019 Calendar On-Premise

If you are connecting your calendar via Other Calendars and encountering any issues, this guide will help you understand the key requirements and configurations needed for a successful setup.

Sembly and other external calendar services can integrate with Microsoft Exchange Server 2019 using Exchange Web Services (EWS). This article explains how EWS works in this context and walks you through the necessary configuration steps to ensure secure and reliable access. 

Verify EWS is Enabled

Exchange 2019 has EWS enabled by default, but you should confirm:

1. Open Exchange Management Shell (EMS).

2. Run the command:

   Get-WebServicesVirtualDirectory | Format-List Name,Server,InternalUrl,ExternalUrl

3. Make sure InternalUrl and ExternalUrl are set correctly.
   • ExternalUrl is required if the service connects from outside your network.

Set or Update the EWS URL

If your EWS URL needs updating for external access:

Set-WebServicesVirtualDirectory -Identity "EWS (Default Web Site)" -ExternalUrl https://mail.yourdomain.com/EWS/Exchange.asmx

• Replace https://mail.yourdomain.com with your actual Exchange external domain.
• Verify connectivity:

Test-WebServicesConnectivity -ClientAccessServer <YourServerName> -Service EWS

Create a Service Account

Most external services require a dedicated account:

1. Create a user account in Active Directory.
2. Assign ApplicationImpersonation if the service needs access to multiple mailboxes:

New-ManagementRoleAssignment -Name:impersonationAssignmentName -Role:ApplicationImpersonation -User:serviceAccount

• Replace serviceAccount with your service account name.

Configure Mailbox Permissions (Optional)

If the service accesses a specific mailbox:

Add-MailboxPermission -Identity user@domain.com -User serviceAccount -AccessRights FullAccess

Enable Authentication

Some integrations still use Basic Authentication; Microsoft recommends OAuth 2.0:

1. Check current EWS authentication:

Get-WebServicesVirtualDirectory | Format-List Name,Server,BasicAuthentication,WindowsAuthentication

2. Enable Basic Authentication (if necessary):

Set-WebServicesVirtualDirectory -Identity "EWS (Default Web Site)" -BasicAuthentication $true

For production, use OAuth 2.0 for better security.

Test Connectivity

The external service will typically need:

• EWS URL: https://mail.yourdomain.com/EWS/Exchange.asmx
• Username & password: service account credentials
• Domain: Active Directory domain
• Optional: Impersonation for multiple mailboxes

Firewall & SSL

• Ensure port 443 is open for HTTPS traffic from the external service.
• Use a valid SSL certificate that matches your external domain.

Enable OAuth (Optional)

For modern, secure integration:

1. Register your application in Azure AD (for Hybrid/Office 365) or ADFS (on-prem).
2. Grant EWS.AccessAsUser.All permission.
3. Configure the service with Client ID, Tenant ID, and Secret.

Troubleshooting

If issues occur, try:

• Restarting Exchange services
• Resetting OWA virtual directories
• Installing the latest Cumulative Update (CU)