Consider the following scenario:
You have a hybrid deployment of Microsoft Exchange Online in Microsoft Office 365 and of on-premises Microsoft Exchange Server that contains Microsoft Exchange Server 2013 and Microsoft Exchange Server 2007. Or, two organizations are federated, and at least one of them has Exchange Server 2007.
Exchange Server 2013 has Cumulative Update 5 installed.
Exchange Server 2013 and Exchange Server 2007 have different external Exchange Web Services (EWS) URL namespaces.
In this scenario, free/busy lookup from Office 365 mailboxes to on-premises Exchange Server 2007 mailboxes does not work.
This issue occurs because the Exchange Server 2013 Autodiscover service returns the legacy namespace that is configured on Exchange Server 2007 EWS virtual directory after you apply Cumulative Update 5. However, Exchange Server 2007 does not understand the availability call that is coming in from the Exchange Online mailboxes and the Wssecurity authentication method.
Note Prior to Cumulative Update 5, when an Exchange Online mailbox queries the free/busy information about an Exchange Server 2007 mailbox, Exchange Server 2013 returns the Exchange Server 2013 EWS endpoint and performs the Wssecurity authentication successfully, and then proxies the EWS traffic to the Exchange Server 2007 Client Access servers.
To resolve this issue, install Cumulative Update 7 for Exchange Server 2013.
To work around this issue, configure the TargetSharingEpr value in the cloud-based Organization Relationship to point to the external Exchange Server 2013 EWS endpoint.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.