Overview
The Microsoft Teams Exchange Integration monitoring test appears in the Microsoft Teams section of the Office 365, ECLOUD-INTERNET and Remote Probe monitoring nodes.
Monitoring Benefit
The Microsoft Teams Exchange Integration test verifies that the Exchange Online building blocks Teams meetings depend on are reachable for the synthetic user: the mailbox is provisioned, its mailbox settings are readable, and its calendar can be read. It creates nothing — by default this is a read-only probe.
Many Teams meeting problems are Exchange problems wearing a Teams costume. If a user cannot reach their mailbox or calendar, Teams meeting creation and meeting visibility can fail even while the Teams service itself is entirely healthy. This test is the dependency floor: it tells you whether Exchange is the reason, before anyone starts investigating Teams.
Because it is read-only, this test does not indicate a Teams service outage. It reports on the Exchange dependency only.
How do we verify the monitoring test results?
1. Confirm the monitoring credential is valid.
For the Office 365 and ECLOUD-INTERNET monitoring tests, navigate to Server > Tuning Policy > Settings > Office 365 > Microsoft Teams > Microsoft Teams User > Verify Credential.
For the Remote Probe monitoring tests, navigate to Server > Tuning Policy > Settings > Probe Configuration > Configure Probes… > Default Office 365 Settings > Microsoft Teams > Verify Credential.
2. Confirm the mailbox scoping policy still covers the synthetic account.
The application's mailbox reach is restricted by an Exchange Online Application Access Policy naming a mail-enabled security group that contains the synthetic account. If the account is removed from that group, the mailbox and calendar reads begin returning 403 with no change to the application itself.
3. Reproduce the two reads manually.
GET https://graph.microsoft.com/v1.0/users/{synthetic user}/mailboxSettings
GET https://graph.microsoft.com/v1.0/users/{synthetic user}/calendarView
?startDateTime={now}&endDateTime={now+1d}&$top=1
The first should return HTTP 200 with a settings payload such as timeZone and language. The second should return HTTP 200 with a well-formed collection.
An empty calendar is a pass. The check is that the calendar folder is readable, not that the synthetic user has any appointments in the next day. An empty value array is the expected result for a synthetic account and should not be investigated as a fault.
Prerequisites
This test authenticates through an enterprise application registered in Microsoft Entra ID, acquiring a token from login.microsoftonline.com and calling Microsoft Graph at graph.microsoft.com.
The enterprise application requires the following Microsoft Graph application permissions, admin-consented in the tenant:
MailboxSettings.ReadCalendars.ReadCalendars.ReadWrite— only when the optional calendar write probe is enabled. The default read-only configuration does not need it.
The synthetic user needs a provisioned Exchange Online mailbox with calendar access, and exclusion from any Conditional Access policy that would block non-interactive access for the application.
The application's mailbox reach should be restricted by an Exchange Online Application Access Policy, so that the mailbox and calendar permissions grant access to the synthetic mailbox only rather than every mailbox in the tenant.
Common warning or error results, and potential solutions
| Result | Potential solution |
| Authentication failure | Token acquisition failed or Graph returned 401. Re-run Verify Credential. Confirm the client secret or certificate has not expired. |
| Mailbox not provisioned | Graph returned 404 for the mailbox. Confirm the synthetic user still holds an Exchange Online licence and that the mailbox has finished provisioning — a newly licensed account can take some time before its mailbox is reachable. |
| Mailbox access denied | Graph returned 403 on mailbox settings. Either admin consent is missing, or the Exchange Application Access Policy no longer covers this mailbox. |
| Mailbox settings failure | Mailbox settings returned a non-200 that was neither 403 nor 404. Review the recorded Graph error code. |
| Calendar access failure | Mailbox settings were readable but the calendar read was not. Confirm calendar access has not been restricted for the synthetic account separately from mailbox access. |
| Calendar write failure | Only reported when the optional write probe is enabled. The probe's temporary event could not be created. If the create succeeded but its cleanup failed, the run is reported as a warning and the event ID is recorded for removal on the next run. |
| Graph throttling | Graph returned 429. The test honours Retry-After and retries before reporting. |
| Timeout | A call exceeded the per-call timeout with no response. Check outbound connectivity from the monitoring node. |
| Unknown error | A failure outside the categories above. Review the recorded HTTP status and Graph error code. |
How this test differs from Teams Calendar Integration
The two are deliberately layered and share the same synthetic user and the same Application Access Policy, which is what makes reading them together useful:
- Teams Exchange Integration (this test) reads. Mailbox settings, then calendar. Nothing is created.
- Teams Calendar Integration writes. It creates a real calendar-backed Teams meeting, checks for a join URL, then deletes it.
A failure here explains a failure there. If this test fails, do not investigate Teams Calendar Integration separately — fix the Exchange dependency first and re-check.
Related monitoring tests
- Microsoft Teams - Calendar Integration — the calendar-backed meeting creation path.
- Microsoft Teams - Online Meeting — Teams meeting creation with Exchange out of the picture entirely.
Comments
0 comments
Please sign in to leave a comment.