Summary
After you install this update for Microsoft Exchange Server 2019 or Exchange Server 2016, using the Set-OrganizationConfig cmdlet to set the EnableAuthAdminReadSession -Setting option to True can enable a recipient read session. Setting the option to False enables a recipient write session.
The scenario is applicable for customers with HMA (Hybrid Modern Authentication). For the end users, the impact is that users can't connect and access their mailboxes because they're stuck in authentication prompt loops.
The problem is that the server rejects authorization requests for a period of up to 30 minutes after the first Bearer authorization request hits a "newly spawned" worker process and certificates/keys are changed in Azure Active Directory (Azure AD). This happens especially when a server is brought back from maintenance and reintegrated to a load balancer pool, or a process is recycled or restarted, either through a crash or managed availability. When the recipient session is changed to read-only for the authentication admin application, which is the job responsible for updating certificates through an anchor job, certificates get updated to local AD and the authentication is successful.
How to get this update
To get this update, install one of the following updates:
For Exchange Server 2019, install the Cumulative Update 6 for Exchange Server 2019 or a later cumulative update for Exchange Server 2019.
For Exchange Server 2016, install the Cumulative Update 17 for Exchange Server 2016 or a later cumulative update for Exchange Server 2016.
References
Learn about the terminology that Microsoft uses to describe software updates.
