Introducing the Exchange Online Fiddler Extension

Working in support we deal with a lot of organisations which are migrating from Exchange On-Premise to Exchange Online. We spent plenty of time troubleshooting if Outlook has difficulties connecting to cloud mailboxes or on other related issues. We continually use tools such as The Support and Recovery Assistant (SARA), particularly useful to detect client based issues is the Collect Information about my Outlook configuration option in SARA, Outlook ETL files (can only be viewed by Microsoft support), and Fiddler traces to see the conversation between the Outlook client and the server - Exchange Online / Office 365 / Authentication or Federation provider.

This post is about the Exchange Online Fiddler Extension which enhances the Fiddler UI to make troubleshooting Outlook connectivity with Exchange Online easier and more efficient.

If you already know what this is then you are probably just looking for the download link: https://github.com/jprknight/EXOFiddlerExtension/releases.

Or the wiki page: https://github.com/jprknight/EXOFiddlerExtension/wiki

Or for questions, issues or suggestions: https://github.com/jprknight/EXOFiddlerExtension/issues

What does the extension do?

• Colourise sessions.
  • Sessions are coloured according to their relevance to a known condition or failure.
  • Think traffic light colours with some additions.
  • See https://github.com/jprknight/EXOFiddlerExtension/wiki/Extension-Colour-Code-Explanation for more details.
• Additional columns added to UI.
  • Elapsed time -- Shown when loading a SAZ file if enabled.
  • Response server -- The type of web server which responded to the request.
  • Exchange Type -- This is a field populated from logic checks based on request and response values. This will contain the client used, type of connection, or process if not related to Exchange or Outlook.
  • X-HostIP -- This is the IP address of the responding host. It can be very useful to know if the responding server is on the LAN vs. the internet.
• Inspector tab added to the UI.
  • The extension adds an Exchange Online tab to the response inspector list.
  • This tab brings together useful information for troubleshooting issues.
  • Expect to see information from the sessions along with logic based comments in the response comments box.
• Application Logging.
  • Logs the logic checks the extension finds on sessions into the Fiddler application log for viewing.
  • Go to the logging tab to see all the events recorded on all sessions.
• Update Checking.
  • The extension checks for available updates, so you don't get left behind running an old version.
  • From v1.0.50 the Exchange Online menu will update it's title to give you a visual cue an update is available. -- See the menu screenshot at the bottom of this post.
• Menu added to the UI to control the extension.
  • Extension Enabled -- Running the extension with all options turned on involves a performance cost. You can turn off the extension if not currently using it. This will stop all session logic processing, the expensive compute cost of running the extension.
  • Columns enable/disable.
  • Application Logging Enabled -- Enable/disable switch for the application logging.
  • Extension Wiki -- Link out to the project Wiki.
  • Report Issues -- Link out to the project issues page.
  • Check for updates -- Extension checks against updates.
    Note: Set the options you want on the menu and restart Fiddler for changes to take effect.

What kind of scenarios can the extension help me troubleshoot?

• Authentication:
  • ADFS or third-party federation provider is unreachable or unavailable. No authentication tokens generated for users as they request them means no access to Office 365 resources.
  • Outlook throwing unexpected authentication prompts.
• Autodiscover:
  • Autodiscover not responding or responding with incorrect information.
  • An Autodiscover response from a non-Exchange server.
• Network Connectivity:
  • Web proxy or other device blocking Outlook traffic from reaching the internet and Office 365 / Exchange Online.
  • Outlook cannot connect to an Exchange Online mailbox.
  • Outlook cannot communicate with an Exchange server - either On-Premise or in Exchange Online.
• Performance troubleshooting:
  • Check the length of time sessions take to complete.
  • Check the length of time the Exchange Online server took to service the request 'Server Think Time'.
  • Check the length of time it took to send the response back to Fiddler and for Fiddler to relay the response back to the client app (Outlook).
• Others:
  • OWA cannot connect to an Exchange Online mailbox.
  • Outlook or OWA cannot perform a specific function with the mailbox.
  • Exchange Free/Busy and other EWS calls.

What does it look like?

Colourisation of sessions and additional columns

Prior to installing and enabling the extension all sessions would be shown in white. The extension is using logic to detect the severity of session responses and highlight what we need to focus on for troubleshooting.

See the Extension Colour Code Explanation wiki page for more details on what these colours mean.

In this lab sample a squid proxy has been installed which is set to block all traffic for outlook.office365.com. Client computers in the environment are set to route all internet traffic through the proxy server. The result is Outlook cannot connect to the Exchange Online mailbox and HTTP 403 responses are seen from the web proxy server on the disallowed traffic.

Notice the addition of the Elapsed Time, Response Server, Exchange Type, and X-HostIP columns.

Update (10/15/2018): Exchange Type is now louder about any specific scenario found, shown in the screenshots below. Look for anything in Exchange Type in capital letters enclosed in exclamation marks. For example: !FEDERATION! or !WEB PROXY BLOCK!

Highlight on HTTP 403, sessions are being blocked by a web proxy server.

This HTTP 503 Service Unavailable was simulated in a lab by taking the 'Active Directory Federation Services' service offline on the Web Application Proxy server.

Inspector Tab

HTTP 200's: Not all 200 OK server responses are actually OK. Some contain an error, failure or exception response. Unless a specific scenario is detected for HTTP 200 OK responses the extension is splitting each word in the response body and looking for 'error', 'failed', or 'exception'. If found the session will be highlighted with red text on a black background in the session list, the Exchange Type will show !FAILURE LURKING!

A HTTP 200 OK server response which is actually OK.

In this however, the HTTP 200 is an Autodiscover response from Exchange On-Premise server with a redirect address (you may know this as the target address or remote routing address). The response is exactly what we want in this scenario so this session is coloured green in the session list.

HTTP 403 Forbidden

This HTTP 403 Forbidden accompanies the session colourisation scenario above. This is one of the HTTP 403 responses from that trace. The tell in this scenario is the response server is squid/3.5.27, which is configured to block Outlook's traffic for outlook.office365.com. This session is highlighted as red in the session list. This could just as easily be another brand of web proxy server showing up in the same scenario, squid just happens to be an easy way to reproduce this behaviour in a lab environment.

HTTP 503 Service Unavailable

This HTTP 503 Service Unavailable was simulated in a lab by taking the 'Active Directory Federation Services' service offline on the Web Application Proxy server. This means when the Outlook client hits the realm page for basic authentication (shown below), Exchange Online takes over and attempts to authenticate on behalf of the user to the federation service, it is offline and cannot service the authentication request. At this point Outlook most likely prompts for credentials which cannot be satisfied, and cannot connect to the Exchange Online mailbox.

Menu to control the extension

From v1.0.50 of the extension the menu will now give you a visual cue if there is an update available. Use the 'Check for update' menu option or visit https://github.com/jprknight/EXOFiddlerExtension/releases to download the update.

Here's hoping this extension helps you troubleshoot an Outlook or Exchange issue. Further information can be found here: https://github.com/jprknight/EXOFiddlerExtension/wiki

Any queries, issues or questions can be posted here: https://github.com/jprknight/EXOFiddlerExtension/issues.

Happy troubleshooting!

Comments

• Anonymous
  October 20, 2018
  Great stuff! :-DIs the extension also working with Exchange 2016/2019 on-prem??Thanks!!!
  • Anonymous
    October 22, 2018
    Hi,That’s a great question. There is no reason why you could not use it with Exchange On-Premise, you will still see things like authentication, Autodiscover, and/or network connectivity success or failure. I work predominantly with customers using Exchange Online, so a lot of the rule set in the extension will lean in the direction of, for example, the potential issues of the changeover from Outlook connecting to an Exchange server on the LAN to an Exchange server hosted in Office 365.Thank you,Jeremy.
• Anonymous
  November 20, 2018
  Thanks for the tool and great article..
  • Anonymous
    November 21, 2018
    Your very welcome!