Outlook can't connect (MAPI/HTTP) checklist

Symptoms to confirm

Creating a profile fails, often right after Autodiscover seemed to succeed:

The action cannot be completed. The connection to Microsoft Exchange is unavailable.
Outlook must be online or connected to complete this action.

• Existing profiles show Disconnected in the status bar.
• Opening public folders or an online archive fails with Cannot expand the folder. Microsoft Exchange is not available. Either there are network problems or the Exchange server is down for maintenance.
• OWA works for the same user, so the account and the mailbox database are fine.
• If users fail on and off, suspect one server behind the load balancer; if everyone fails right after patching, suspect server state.

Likely causes

Outlook gets its MAPI over HTTP URLs from Autodiscover, then opens HTTPS sessions to /mapi/emsmdb (the mailbox) and /mapi/nspi (the address book) on your namespace.

Checklist

1. 1

   Rule out the mailbox's protocol settings

   powershell

   Get-CASMailbox jane@contoso.com | Format-List *Mapi*
   Get-OrganizationConfig | Format-List MapiHttpEnabled
   Set-CASMailbox jane@contoso.com -MAPIEnabled $true

   MAPIEnabled must be True; when it's False, Outlook shows exactly the errors above. The mailbox-level MapiHttpEnabled is normally empty, which means it follows the organization setting.

2. 2

   Confirm Autodiscover returns MAPI URLs

   Run Test E-mail AutoConfiguration (Ctrl + right-click the Outlook icon in the notification area). The Results tab should list URLs such as https://mail.contoso.com/mapi/emsmdb/?MailboxId=<GUID>@contoso.com on your namespace.

3. 3

   Check the MAPI virtual directory on every server

   powershell

   Get-MapiVirtualDirectory | Format-List Server, InternalUrl, ExternalUrl, IISAuthenticationMethods
   Set-MapiVirtualDirectory -Identity "EX01\mapi (Default Web Site)" `
       -InternalUrl https://mail.contoso.com/mapi -ExternalUrl https://mail.contoso.com/mapi

   Both URLs should use the load-balanced name on your certificate, identical on every server. If ExternalUrl is empty, clients outside the network aren't offered MAPI over HTTP.

4. 4

   Check components, health and app pools

   powershell

   Get-ServerComponentState EX01 | Where-Object State -ne "Active" | Format-Table Component, State
   Get-HealthReport EX01 | Where-Object { $_.HealthSet -like "*Mapi*" -or $_.HealthSet -like "Outlook*" } |
       Format-Table HealthSet, AlertValue
   Import-Module WebAdministration
   Get-ChildItem IIS:\AppPools | Where-Object { $_.Name -like "MSExchangeMapi*" } | Select-Object Name, State

   ForwardSyncDaemon and ProvisioningRps are normally Inactive on-premises. Anything else Inactive, such as ServerWideOffline, usually means a server was left in maintenance mode after patching:

   powershell

   Set-ServerComponentState EX01 -Component ServerWideOffline -State Active -Requester Maintenance

5. 5

   Test healthcheck.htm and fix the load balancer

   powershell

   Invoke-WebRequest https://mail.contoso.com/mapi/healthcheck.htm -UseBasicParsing | Select-Object StatusCode, Content

   A healthy server answers 200 with 200 OK and its own FQDN in the body. Each protocol has its own page (/owa, /ews, /mapi, /rpc, /oab, /Microsoft-Server-ActiveSync, /autodiscover), and it stops returning 200 when Managed Availability takes that protocol offline or its component is set Inactive.

6. 6

   Check the client

   A MapiHttpDisabled DWORD set to 1 under HKCU\Software\Microsoft\Exchange stops Outlook from using MAPI over HTTP; it's sometimes left behind by an old script or policy. Remove it unless you deliberately rely on Outlook Anywhere, then restart Outlook.

Verify

• Ctrl + right-click the Outlook icon › Connection Status: every line shows Established with protocol HTTP, and the Req/Fail column shows no new failures.
• A new profile completes, and the Outlook tests on the Exchange Server tab of the Microsoft Remote Connectivity Analyzer pass from outside.
• The HttpProxy log shows successful requests for the user:

$log = Join-Path $env:ExchangeInstallPath "Logging\HttpProxy\Mapi"
Get-ChildItem $log | Sort-Object LastWriteTime | Select-Object -Last 1 | Select-String "jane" | Select-Object -Last 5

Prevent it next time

• Probe each protocol separately on the load balancer, and drain servers through maintenance mode before patching.
• After every update, confirm all components are Active and run the Health Checker; install updates elevated, as covered in installing Exchange security updates.
• Keep virtual directory URLs identical on every server and covered by the certificate.
• Record any per-mailbox protocol changes made during testing, and undo them afterwards.