Outlook Web Access (OWA) 2013 SP1 & 2016 Integration Guide

1. In the Profile Fields section, map the userPrincipalName to a SecureAuth IdP Property (e.g. Email 2)

2. Select WS-Federation Assertion from the Authenticated User Redirect dropdown in the Post Authentication section

3. An unalterable URL will be auto-populated in the Redirect To field, which will append to the domain name and realm number in the address bar (Authorized/WSFedProvider.aspx)

4. Select the SecureAuth IdP Property that corresponds to the directory field that contains the userPrincipalName (Email 2)

5. Select urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified from the Name ID Format dropdown (default)

6. Select False from the Encode to Base64 dropdown

7. Set the WSFed/SAML Issuer to https://SecureAuthIdPFQDN/SecureAuthIdPRealm#/ and replace the values with the actual Fully Qualified Domain Name (FQDN) of the SecureAuth IdP appliance and the OWA integration realm number, e.g. SecureAuth2

For example, https://secureauth.company.com/secureauth2

8. Set the SAML Audience to https://mail.companyname.com/owa/ and replace "mail.companyname.com" with the actual DNS value

9. Leave the Signing Cert Serial Number as the default value, unless there is a third-party certificate being used for the SAML assertion

If using a third-party certificate, click Select Certificate and choose the appropriate certificate

10. Set the Name of Attribute 1 to UPN

11. Set the Namespace (1.1) to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn

12. Select Email 2 (or the field that contains the userPrincipalName) from the Value dropdown

The Value here and the User ID Mapping selections will be the same

1. On the Exchange server, run Notepad elevated (Run as Administrator), and open C:\Program Files\Microsoft\Exchange Server\V15\Frontend\HttpProxy\Owa\web.config

2. Add the following text to the <configSections > at the top of the file:

<!-- SecureAuth -->
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
    <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
<!-- /SecureAuth -->

If the <configSections> does not exist, add the following immediately under <configuration>:

<!-- SecureAuth -->
<configSections>
        <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
    <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
  </configSections>
<!-- SecureAuth -->

3. If <configSections> is present, comment out the follow line from the <configSections> (in XML markup, comment out a section by adding <!-- at the beginning of the commented out line and --> at the end, which can span multiple lines):

<!-- <section name="microsoft.identityModel" type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" /> --> 

4. Retrieve the Certificate "Thumbprint" from the SecureAuth IdP Signing Certificate (step 9)

Open the Signing Certificate in the Certificate MMC, click on the Details tab, scroll to the bottom and find the Thumbprint item

Copy the value, paste into Notepad

Remove all spaces and change all letters to UPPERCASE

5. Add the below lines right after <location inheritInChildApplications="false"> at the top of the file

The Thumbprint and other values must be changed from this default content

Replace the "mail.companyname.com" in the https://mail.companyname.com/owa/ value with the actual DNS value (three instances)

This is the same value provided in the SAML Audience field in the SecureAuth IdP Web Admin (step 8)

Replace YOURCERTTHUMBPRINTHERE with the content from step 4 (one instance)

Replace https://SecureAuthIdPFQDN/SecureAuthIdPRealm# with the actual FQDN of the SecureAuth IdP appliance, followed by the realm number, e.g. https://secureauth.company.com/secureauth2 (two instances)

This value must match exactly with the WSFed/SAML Issuer value established in the SecureAuth IdP Web Admin (step 7)

NOTE: If configuring a transparent SSO realm, append the URL with /Authorized/WSFedProvider.aspx

<!-- SecureAuth -->
<system.identityModel>
  <identityConfiguration>
    <securityTokenHandlers>
      <remove type="System.IdentityModel.Tokens.SamlSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      <remove type="System.IdentityModel.Tokens.Saml2SecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      <add type="System.IdentityModel.Tokens.SamlSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
        <samlSecurityTokenRequirement mapToWindows="true" />
      </add>
      <add type="System.IdentityModel.Tokens.Saml2SecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
        <samlSecurityTokenRequirement mapToWindows="true" />
      </add>
      <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      <add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
    </securityTokenHandlers>
    <audienceUris>
      <add value="https://mail.companyname.com/owa/" />
    </audienceUris>
    <issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
      <trustedIssuers>
        <add thumbprint="YOURCERTTHUMBPRINTHERE" name="https://SecureAuthIdPFQDN/SecureAuthIdPRealm#" />
      </trustedIssuers>
    </issuerNameRegistry>
  </identityConfiguration>
</system.identityModel>
<system.identityModel.services>
  <federationConfiguration>
    <cookieHandler requireSsl="true" path="/" />
    <wsFederation passiveRedirectEnabled="true" issuer="https://SecureAuthIdPFQDN/SecureAuthIdPRealm#" realm="https://mail.companyname.com/owa/" reply="https://mail.companyname.com/owa/" requireHttps="true" />
  </federationConfiguration>
</system.identityModel.services>
<!-- /SecureAuth -->

6. Change the <modules> tag to <modules runAllManagedModulesForAllRequests="true">

7. At the top of the <modules> section, add the following:

<!-- SecureAuth -->
        <add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="" />
        <add name="WSFederationAuthenticationModule" type="System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="" />
<!-- /SecureAuth -->

<add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="" /> 

8. To ensure sign out to function, add the following lines under the commented area in <assemblies>:

<!-- SecureAuth --> 
    <add assembly="System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
<!-- SecureAuth --> 

9. Modify (or add) the following lines within the <appSettings> section:

Be sure to replace https://SecureAuthIdPFQDN/SecureAuthIdPRealm# with the actual FQDN and OWA-integrated realm number, e.g. https://secureauth.company.com/secureauth2 (two instances)

This value must match exactly with the WSFed/SAML Issuer value established in the SecureAuth IdP Web Admin (step 7)

NOTE: If configuring a transparent SSO realm, append the URL with /Authorized/WSFedProvider.aspx

<!-- SecureAuth -->
    <add key="ida:FederationMetadataLocation" value="https://SecureAuthIdPFQDN/SecureAuthIdPRealm#/FederationMetadata/2007-06/FederationMetadata.xml" />
    <add key="ida:Issuer" value="https://SecureAuthIdPFQDN/SecureAuthIdPRealm#" />
    <add key="ida:ProviderSelection" value="Secureauth" />
<!-- SecureAuth -->

10. Save the file

11. Open the Internet Information Services (IIS) Manager

12. Expand the site where OWA is installed, and click owa

13. Double-click the Authentication icon and verify that all authentications are set to Disabled

1. On the Exchange server, run Notepad elevated (Run as Administrator), and open C:\Program Files\Microsoft\Exchange Server\V15\Frontend\HttpProxy\ecp\web.config

2. At the top of the file, add the following to the <configSections>:

<!-- SecureAuth -->
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
    <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
<!-- /SecureAuth -->

If <configSections> does not exist, add the following immediately under <configuration>:

<!-- SecureAuth -->
<configSections>
        <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
    <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
  </configSections>
<!-- SecureAuth -->

3. If <configSections> is present, comment out the follow line from the <configSections> (in XML markup, comment out a section by adding <!-- at the beginning of the commented out line and --> at the end, which can span multiple lines):

<!-- <section name="microsoft.identityModel" type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" /> -->

4. Modify (or add) the following lines within the <appSettings> section:

Be sure to replace https://SecureAuthIdPFQDN/SecureAuthIdPRealm# with the actual FQDN and OWA-integrated realm number, e.g. https://secureauth.company.com/secureauth2 (two instances)

This value must match exactly with the WSFed/SAML Issuer value established in the SecureAuth IdP Web Admin (step 7)

<!-- SecureAuth -->
    <add key="ida:FederationMetadataLocation" value="https://SecureAuthIdPFQDN/SecureAuthIdPRealm#/FederationMetadata/2007-06/FederationMetadata.xml" />
    <add key="ida:Issuer" value="https://SecureAuthIdPFQDN/SecureAuthIdPRealm#" />
    <add key="ida:ProviderSelection" value="Secureauth" />
<!-- SecureAuth -->

5. Add the below lines right after </appSettings>

The Thumbprint and other values must be changed from this default content

Replace the "mail.companyname.com" in the https://mail.companyname.com/ecp/ value with the actual DNS value (three instances)

This is the same value provided in the SAML Audience field in the SecureAuth IdP Web Admin (step 8)

Replace YOURCERTTHUMBPRINTHERE with the Certificate "Thumbprint" retrieved from the SecureAuth IdP Signing Certificate

Replace https://SecureAuthIdPFQDN/SecureAuthIdPRealm# with the actual FQDN of the SecureAuth IdP appliance, followed by the realm number, e.g. https://secureauth.company.com/secureauth2 (two instances)

This value must match exactly with the WSFed/SAML Issuer value established in the SecureAuth IdP Web Admin (step 7)

<!-- SecureAuth -->
<system.identityModel>
  <identityConfiguration>
    <securityTokenHandlers>
      <remove type="System.IdentityModel.Tokens.SamlSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      <remove type="System.IdentityModel.Tokens.Saml2SecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      <add type="System.IdentityModel.Tokens.SamlSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
        <samlSecurityTokenRequirement mapToWindows="true" />
      </add>
      <add type="System.IdentityModel.Tokens.Saml2SecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
        <samlSecurityTokenRequirement mapToWindows="true" />
      </add>
      <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      <add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
    </securityTokenHandlers>
    <audienceUris>
      <add value="https://mail.companyname.com/owa/" />
    </audienceUris>
    <issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
      <trustedIssuers>
        <add thumbprint="YOURCERTTHUMBPRINTHERE" name="https://SecureAuthIdPFQDN/SecureAuthIdPRealm#" />
      </trustedIssuers>
    </issuerNameRegistry>
  </identityConfiguration>
</system.identityModel>
<system.identityModel.services>
  <federationConfiguration>
    <cookieHandler requireSsl="true" path="/" />
    <wsFederation passiveRedirectEnabled="true" issuer="https://SecureAuthIdPFQDN/SecureAuthIdPRealm#" realm="https://mail.companyname.com/owa/" reply="https://mail.companyname.com/ecp/" requireHttps="true" />
  </federationConfiguration>
</system.identityModel.services>
<!-- /SecureAuth -->

6. Change the <modules> tag to <modules runAllManagedModulesForAllRequests="true">

7. Within the <modules> section, add the following:

<!-- SecureAuth -->
        <add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="" />
        <add name="WSFederationAuthenticationModule" type="System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="" />
<!-- /SecureAuth -->

<add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="" />

8. To ensure sign out to function, add the following lines under the commented area in <assemblies>:

<!-- SecureAuth --> 
    <add assembly="System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
<!-- SecureAuth --> 

9. Save the file

10. Ensure that the Machine Key configurations match for OWA and ECP

IIS Manager > OWA > Machine Keys

IIS Manager > ECP > Machine Keys

11. Open the Internet Information Services (IIS) Manager

12. Expand the site where ECP is installed, and click ecp

13. Double-click the Authentication icon and verify that all authentications are set to Disabled

14. System.IdentityModel.Services was already added to the web.config files in previous steps

15. In Logout.aspx under OWA\Auth\Logoff.aspx, add the following at the top under <%@ Page language...>

<!-- SecureAuth --> 
    <%@ Import namespace="System.IdentityModel.Services"%>
<!-- SecureAuth --> 

16. Under <body class...>, enter the following:

<!-- SecureAuth --> 
    <% FederatedAuthentication.SessionAuthenticationModule.Signout(); %>
<!-- SecureAuth --> 

1. Add the following code as a web.config file to the folder with the highest version of the Cumulative Update

e.g.: \Exchange Server\Vxx\ClientAccess\ecp\xx.x.xxx.xxx\web.config

<?xml version="1.0"?>
<configuration>
    <location path="Themes">
        <system.web>
            <authorization>
                <!--<allow users="*"/>-->
                <allow users="?"/>
            </authorization>
        </system.web>
    </location>
            <location path="Scripts">
        <system.web>
            <authorization>
                <!--<allow users="*"/>-->
                <allow users="?"/>
            </authorization>
        </system.web>
    </location>
</configuration>

URL Rewrites (Optional)

URL Rewrites

These are optional configurations and not required for the integration

URL Rewrite to Resolve Trailing Slash Issues

URL Rewrite to Resolve Trailing Slash Issues

Note

Both the OWA and ECP applications have issues if a trailing slash is missing

To avoid these issues, use URL Rewrite

1. Download and install URL Rewrite for IIS

2. Open IIS, browse to Default Web Site, and select URL Rewrite

3. Click Add Rule(s) under Actions

4. Set the Name to Trailing Slash Fix

5. Select Matches the Pattern from the Requested URL dropdown

6. Set the Pattern to (.*[^/])$

7. Expand the Conditions section

8. Select Match Any from the Logical Grouping dropdown

9. Click Add to include Condition 1

Condition 1 Configuration Steps

10. Set the Condition Input to {URL}

11. Select Matches the Pattern from the Check if input string dropdown

12. Set the Pattern to ^/owa$

13. Click OK

14. Click Add to include Condition 2

NOTE: In some environments Condition 2 should not be used if it causes "too many redirects".

Condition 2 Configuration Steps

15. Set the Condition Input to {URL}

16. Select Matches the Pattern from the Check if input string dropdown

17. Set the Pattern to ^/ecp$

18. Click OK

19. Expand the Action section

20. Select Redirect from the Action Type dropdown

21. Set the Redirect URL to {R:1}/

22. Select Permanent (301) from the Redirect Type dropdown

23. Click Apply in the upper right-hand corner, under Actions

URL Rewrite to Resolve Logout Issues

URL Rewrite to Resolve Logout Issues

To avoid logout issues, use URL Rewrite (available here) on the OWA web server to redirect users appropriately

1. Open IIS, browse to Default Web Site, and select URL Rewrite

2. Click Add Rule(s) under Actions, and select Blank Rule

3. Two (2) Logout Redirect Rules are necessary

Note

When configuring OWA 2016 Logout Redirect Rules, on D:\SecureAuth\SecureAuthRealm# replace wsfedsignout.aspx and wsfedsignout.aspx.vb with the contents from the WSFedSignOut.zip file. Contact SecureAuth Support to learn more,

Logout Redirect Rule 1

4. Set the Name to Redirect Logout Rule 1

5. Select Matches the Pattern from the Requested URL dropdown

6. Select Regular Expressions from the Using dropdown

7. Set the Pattern to ^owa/logoff\.owa$

8. Expand the Action section

9. Select Redirect from the Action Type dropdown

10. Set the Redirect URL to the FQDN of the SecureAuth IdP appliance, followed by the OWA 2013 SP1 / 2016 realm number, and

wsfedsignout.aspx?wa=wsignout1.0&wreply=https://secureauth.company.com/owa/?wa=wsignoutcleanup1.0

For example, https://secureauth.company.com/secureauth2/wsfedsignout.aspx?wa=wsignout1.0&wreply=https://secureauth.company.com/owa/?wa=wsignoutcleanup1.0

11. Select Permanent (301) from the Redirect Type dropdown

12. Click Apply in the upper right-hand corner, under Actions

Second Logout Redirect Rule

13. Set the Name to Redirect Logout Rule 2

14. Select Matches the Pattern from the Requested URL dropdown

15. Select Regular Expressions from the Using dropdown

16. Set the Pattern to ^owa/auth/logoff\.aspx$

17. Expand the Action section

18. Select Redirect from the Action Type dropdown

19. Set the Redirect URL to the FQDN of the SecureAuth IdP appliance, followed by the OWA 2013 SP1 / 2016 realm number, and

wsfedsignout.aspx?wa=wsignout1.0&wreply=https://secureauth.company.com/owa/?wa=wsignoutcleanup1.0

For example, https://secureauth.company.com/secureauth2/wsfedsignout.aspx?wa=wsignout1.0&wreply=https://secureauth.company.com/owa/?wa=wsignoutcleanup1.0

20. Select Permanent (301) from the Redirect Type dropdown

21. Click Apply in the upper right-hand corner, under Actions

Alternate URL Rewrite Setup Method

Alternate URL Rewrite Setup Method

1. Download and install URL Rewrite for IIS

2. Open the Internet Information Server Manger

3. In the Connections list, expand the IIS Server Name, and then expand Sites

4. Right-click on Default Web Site, and select Explore

5. Copy the Path from the explorer window

6. Open Notepad, running in the Administrator context ( Run as Administrator)

7. Select File, then Open

8. Change the extension to All Files: (*.*)

9. Paste the Path into the File name and click Open

10. Select the web.config file and click Open again

11. The contents of the web.config file should look similar to the following:

Default web.config

<configuration>
  <location inheritInChildApplications="false">
    <system.webServer>
      <modules>
        <add name="OwaUrlModule" type="Microsoft.Exchange.HttpProxy.OwaUrlModule,Microsoft.Exchange.OwaUrlModule,Version=15.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35"
preCondition="" />
      </modules>
    </system.webServer>
    <system.web>
      <machineKey validationKey="AutoGenerate,IsolateApps" />
      <compilation defaultLanguage="c#" debug="false">
        <assemblies>
          <add assembly="Microsoft.Exchange.OwaUrlModule, Version=15.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
        </assemblies>
      </compilation>
    </system.web>
  </location>
    <system.webServer>
       <tracing>   
                  <traceFailedRequests>
            <add path="*">
                 <traceAreas>
                    <add provider="ASP" verbosity="Verbose" />
                    <add provider="ASPNET" areas="Infrastructure,Module,Page,AppServices" verbosity="Verbose" />
                    <add provider="ISAPI Extension" verbosity="Verbose" />
                    <add povider="WWW Server" areas="Authentication,Security,Filter,StaticFile,CGI,Compression,Cache,RequestNotifications,Module,FastCGI" verbosity="Verbose" />
                 </traceAreas>
               <failureDefinitions timeTaken="00:00:00" statusCodes="301-307, 500-599" />
            </add>
          </traceFailedRequests>
        </tracing>
    </system.webServer>
</configuration>

12. Edit the below content with the following value changes:

Replace <SecureAuthIdPFQDN/SecureAuthIdPRealm#> with the FQDN of the SecureAuth IdP appliance, followed by the OWA integration realm number, e.g. secureauth.company.com/secureauth2 (two instances)

Replace <EXCHANGE.YOURCOMPANY.COM> with the FQDN of the OWA Exchange Server, e.g. exchange.company.com (two instances)

Note

When configuring OWA 2016 URL Rewrite Rules to Resolve the Logout, change both of the Redirect URLs to:

https://your.secureauth.box/secureauth1/wsfedsignout.aspx?wa=wsignout1.0&wreply=https://your.owabox.com/owa/?wa=wsignoutcleanup1.0

<rewrite>
    <rules>
        <clear />
           <rule name="Trailing Slash Fix" stopProcessing="true">
                <match url="(.*[^/])$" />
                                <conditions logicalGrouping="MatchAny" trackAllCaptures="false">
                    <add input="{URL}" pattern="^/owa$" />
                    <add input="{URL}" pattern="^/ecp$" />
                                </conditions>
                <action type="Redirect" url="{R:1}/" />
           </rule>
           <rule name="Redirect Logout Requests" stopProcessing="true">
                <match url="^owa/logoff\.owa$" />                   
                                <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                <action type="Redirect" url="https://<SecureAuthIdPFQDN/SecureAuthIdPRealm#>/wsfedsignout.aspx" />
           </rule>
           <rule name="Redirect Logout Requests II" stopProcessing="true">
                <match url="^owa/auth/logoff\.aspx$" />
                                <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                <action type="Redirect" url="https://<SecureAuthIdPFQDN/SecureAuthIdPRealm#>/wsfedsignout.aspx" />
           </rule>
           <rule name="Redir to OWA" enabled="false" stopProcessing="true">
                <match url="(.*)" />
                                <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    <add input="{HTTP_HOST}" pattern="<EXCHANGE.YOURCOMPANY.COM>" />
                                </conditions>
                <action type="Redirect" url="https://<EXCHANGE.YOURCOMPANY.COM>/{R:1}" />
           </rule>
     </rules>
</rewrite>

13. Insert the edited content into the Default Web Site's web.config file after </tracing> and before </System.WebServer>

Sample of Complete Default Web Site Web.Config

******************** Sample web.config ****************************************

<configuration>
  <location inheritInChildApplications="false">
    <system.webServer>
      <modules>
        <add name="OwaUrlModule" type="Microsoft.Exchange.HttpProxy.OwaUrlModule,Microsoft.Exchange.OwaUrlModule,Version=15.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35" preCondition="" />
      </modules>
    </system.webServer>
    <system.web>
      <machineKey validationKey="AutoGenerate,IsolateApps" />
      <compilation defaultLanguage="c#" debug="false">
        <assemblies>
          <add assembly="Microsoft.Exchange.OwaUrlModule, Version=15.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
        </assemblies>
      </compilation>
    </system.web>
  </location>
    <system.webServer>
        <tracing>
            <traceFailedRequests>
                <add path="*">
                    <traceAreas>
                        <add provider="ASP" verbosity="Verbose" />
                        <add provider="ASPNET" areas="Infrastructure,Module,Page,AppServices" verbosity="Verbose" />
                        <add provider="ISAPI Extension" verbosity="Verbose" />
                        <add provider="WWW Server" areas="Authentication,Security,Filter,StaticFile,CGI,Compression,Cache,RequestNotifications,Module,FastCGI" verbosity="Verbose" />
                    </traceAreas>
                    <failureDefinitions timeTaken="00:00:00" statusCodes="301-307, 500-599" />
                </add>
            </traceFailedRequests>
        </tracing>
        <rewrite>
            <rules>
                <clear />
                <rule name="Trailing Slash Fix" stopProcessing="true">
                    <match url="(.*[^/])$" />
                    <conditions logicalGrouping="MatchAny" trackAllCaptures="false">
                        <add input="{URL}" pattern="^/owa$" />
                        <add input="{URL}" pattern="^/ecp$" />
                    </conditions>
                    <action type="Redirect" url="{R:1}/" />
                </rule>
                <rule name="Redirect Logout Requests" stopProcessing="true">
                    <match url="^owa/logoff\.owa$" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                    <action type="Redirect" url="https://secureauth.company.com/secureauth2/wsfedsignout.aspx" />
                </rule>
                <rule name="Redirect Logout Requests II" stopProcessing="true">
                    <match url="^owa/auth/logoff\.aspx$" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                    <action type="Redirect" url="https://secureauth.company.com/secureauth2/wsfedsignout.aspx" />
                </rule>
                <rule name="Redir to OWA" enabled="false" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                        <add input="{HTTP_HOST}" pattern="exchange.company.com" />
                    </conditions>
                    <action type="Redirect" url="https://exchange.company.com/{R:1}" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>
******************** End Sample web.config ****************************************