部署至IIS后Exchange Web Services调用报HTTP 401未授权问题

使用Microsoft.Exchange.WebServices对接Exchange 2019本地版时，发送邮件功能在开发环境（单元测试）可正常运行，但部署至IIS后出现401未授权错误，错误堆栈如下：

Microsoft.Exchange.WebServices.Data.ServiceRequestException: The request failed. The remote server returned an error: (401) Unauthorized.
---> System.Net.WebException: The remote server returned an error: (401) Unauthorized.
at System.Net.HttpWebRequest.GetResponse()
at Microsoft.Exchange.WebServices.Data.EwsHttpWebRequest.Microsoft.Exchange.WebServices.Data.IEwsHttpWebRequest.GetResponse()
at Microsoft.Exchange.WebServices.Data.ServiceRequestBase.GetEwsHttpWebResponse(IEwsHttpWebRequest request)
--- End of inner exception stack trace ---
at Microsoft.Exchange.WebServices.Data.ServiceRequestBase.GetEwsHttpWebResponse(IEwsHttpWebRequest request)
at Microsoft.Exchange.WebServices.Data.ServiceRequestBase.ValidateAndEmitRequest(IEwsHttpWebRequest& request)
at Microsoft.Exchange.WebServices.Data.SimpleServiceRequestBase.InternalExecute()
at Microsoft.Exchange.WebServices.Data.MultiResponseServiceRequest1.Execute() at Microsoft.Exchange.WebServices.Data.ExchangeService.InternalCreateItems(IEnumerable1 items, FolderId parentFolderId, Nullable1 messageDisposition, Nullable1 sendInvitationsMode, ServiceErrorHandling errorHandling)
at Microsoft.Exchange.WebServices.Data.ExchangeService.CreateItem(Item item, FolderId parentFolderId, Nullable1 messageDisposition, Nullable1 sendInvitationsMode)
at Microsoft.Exchange.WebServices.Data.Item.InternalCreate(FolderId parentFolderId, Nullable1 messageDisposition, Nullable1 sendInvitationsMode)
at Microsoft.Exchange.WebServices.Data.EmailMessage.InternalSend(FolderId parentFolderId, MessageDisposition messageDisposition)

开发环境与IIS环境使用完全一致的Exchange配置（URL、凭据等），且IIS站点应用池用户已注册为Exchange邮箱用户。

1. 确认NTLM身份验证相关配置 #

Exchange 2019默认启用NTLM身份验证，需检查：

• 若IIS服务器与Exchange服务器不在同一域，确保两者已建立双向域信任
• 在Exchange服务器注册表中添加DisableLoopbackCheck项（值设为1），避免本地回环验证拦截请求
• 为应用池用户注册正确的SPN服务主体名称，格式为HTTP/<Exchange服务器FQDN>

2. 代码中显式指定EWS身份验证方式 #

避免自动协商验证失败，在代码中强制设置认证类型：

ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2019);
service.Url = new Uri("https://your-exchange-server/EWS/Exchange.asmx");
// 显式指定NTLM认证
service.Credentials = new NetworkCredential("username", "password", "domain");
service.PreAuthenticate = true;
service.Authentication = AuthenticationScheme.Ntlm;

3. 检查IIS应用池用户上下文配置 #

• 启用应用池的「加载用户配置文件」选项（IIS管理器 → 应用池 → 高级设置 → 进程模型 → 加载用户配置文件）
• 若使用内置账户（如ApplicationPoolIdentity），需将该账户添加到Exchange的Exchange Servers组，或直接授予EWS访问权限

4. 验证Exchange EWS访问权限 #

通过Exchange PowerShell确认应用池用户的EWS权限状态：

Get-CASMailbox -Identity "app-pool-user" | Select-Object EwsEnabled

若返回False，执行以下命令启用：

Set-CASMailbox -Identity "app-pool-user" -EwsEnabled $true

5. 排查网络与代理问题 #

• 确认IIS服务器能正常访问Exchange的443端口（EWS默认端口）
• 若存在代理服务器，需在代码中配置代理，或在服务器IE设置中将Exchange服务器加入代理例外列表

内容的提问来源于stack exchange，提问作者JazzyHacker