Introduce an OrganizationConfig flag to enable or disable recipient read session in Exchange Server 2019 and 2016

Applies to: Exchange Server 2019Exchange Server 2016


After you install this update for Microsoft Exchange Server 2019 or Exchange Server 2016, using the Set-OrganizationConfig cmdlet to set the EnableAuthAdminReadSession -Setting option to True can enable a recipient read session. Setting the option to False enables a recipient write session.

The scenario is applicable for customers with HMA (Hybrid Modern Authentication). For the end users, the impact is that users can't connect and access their mailboxes because they're stuck in authentication prompt loops.

The problem is that the server rejects authorization requests for a period of up to 30 minutes after the first Bearer authorization request hits a "newly spawned" worker process and certificates/keys are changed in Azure Active Directory (Azure AD). This happens especially when a server is brought back from maintenance and reintegrated to a load balancer pool, or a process is recycled or restarted, either through a crash or managed availability. When the recipient session is changed to read-only for the authentication admin application, which is the job responsible for updating certificates through an anchor job, certificates get updated to local AD and the authentication is successful.

How to get this update

To get this update, install one of the following updates:

For Exchange Server 2019, install the Cumulative Update 6 for Exchange Server 2019 or a later cumulative update for Exchange Server 2019.​

For Exchange Server 2016, install the 
Cumulative Update 17 for Exchange Server 2016 or a later cumulative update for Exchange Server 2016.


Learn about the terminology that Microsoft uses to describe software updates.