Free‑Busy Not Syncing: Quick Diagnosis

Fix calendar availability between on‑premises and cloud. Start with relationship checks, confirm directory sync, then test HTTPS reachability.

Quick Summary

  • Time: 15–20 minutes total
  • Most common: Organizational relationship misconfigured
  • Scope: Cross‑forest availability lookups only
  • Fix: 10–15 min config; 30 min if directory sync

⚠️ Business Consequence: Why This Matters

  • Financial Impact: Broken calendar sharing = meeting scheduling inefficiency ($2K–$5K per week in lost time)
  • Compliance Exposure: Double-bookings = missed executive meetings, SLA violations
  • Operational Risk: Cross-forest collaboration breaks, departments can't schedule together
  • User Experience: Hybrid coexistence perceived as downgrade from previous system

Average diagnosis time: 15–20 minutes — prevents cascading scheduling failures.

Symptom Recognition: Free-Busy Display Patterns

  • On-premises user checks cloud user's availability in Outlook—shows all time slots as free (cannot find busy blocks)
  • Cloud user checks on-premises user's availability—shows all time slots as free
  • One-way failure: Only one direction broken (on-prem to cloud OR cloud to on-prem)
  • User can see their own busy blocks; problem is cross-forest availability
  • Symptom appeared after directory sync, migration, or network change

🚀 Before You Start

⏱ Time Required

30-40 minutes for full diagnosis and configuration fix

👤 Skill Level

Hybrid Exchange admin with EAC and on-premises Exchange Management Shell access

🛡️ Safety

Read-only diagnostics. Configuration changes documented and tested in pilot group first.

📋 What You'll Need

Exchange admin center access, on-premises Exchange EMS, test mailbox in both forests

⚠️ Stuck or time-sensitive? Request Exchange Security Assessment for hands-on troubleshooting and configuration review.

Error Signals

Use these to pinpoint the failing component:

Free/busy error signals and what each indicates
Signal What It Means
Calendar app shows "Unable to retrieve free/busy" Organizational relationship or firewall blocking HTTPS lookups
Test-OrganizationRelationship fails or returns blank Trust configuration broken; no free-busy URLs configured
403 Forbidden on free/busy HTTPS request Certificate mismatch or authentication failure on AutoDiscover URL
AD Sync shows object missing or mail attributes empty Directory sync not completing; object exists but attributes not synced
Test-MserviceConnection fails on connector Hybrid connector or on-premises Exchange connectivity issue

Root Causes

Typical configuration or connectivity problems:

  • Organization relationship not configured: Free-busy URLs not exchanged between tenants or on-prem forest
  • Directory sync incomplete: New mailbox migrated but mail attributes still null; lookup fails
  • Firewall blocking lookups: HTTP/HTTPS proxy filtering organizational relationship HTTPS calls
  • Certificate mismatch: Free-busy URL points to old or untrusted certificate
  • Connector misconfiguration: Hybrid connector sending requests to wrong endpoint or queue
  • Split DNS: On-premises Outlook resolving AutoDiscover to on-premises server instead of cloud
  • Mailbox type mismatch: Remote mailbox (MailUser) missing proxyaddresses or SMTP mappings

What NOT to Do

  • ❌ Do NOT delete and recreate the organization relationship—requires CAB approval, plan downtime
  • ❌ Do NOT trust all hosts for free-busy (#FreeBusy); this creates a security bypass
  • ❌ Do NOT open firewall to all HTTPS traffic without testing specific URLs first
  • ❌ Do NOT modify mailbox addresses or proxyAddresses without consulting on-premises AD and Azure AD sync
  • ❌ Do NOT force directory sync without understanding what will change

Diagnostics (15–20 min)

Run these tests in order to find the failure point:

Step 1: Verify Hybrid Deployment (3 min)

Run (on-premises Exchange Server):

Get-HybridMailflow

Expected: Shows configured hybrid objects, service endpoint

If blank/error: Hybrid configuration incomplete. Go to remediation.

Step 2: Test Organization Relationship (4 min)

Run (on-premises):

Test-OrganizationRelationship -UserIdentity user@cloud.onmicrosoft.com

Expected: Returns availability data (AvailabilityInfo shows cloud user's calendar)

If error/blank: Trust broken or cloud user not found. Go to Step 3.

Step 3: Verify Directory Sync (3 min)

Run (Azure AD / Microsoft 365):

Get-User -Identity user@contoso.onmicrosoft.com | Select RecipientType, RecipientTypeDetails

Expected: RecipientType = UserMailbox

If RemoteUserMailbox: On-premises mailbox; move to Step 4.

Step 4: Check proxyAddresses and SMTP

Run (on-premises AD):

Get-User user | Select PrimarySmtpAddress, @{N="ProxyAddresses";E={$_.ProxyAddresses -join ";"}}

Expected: Contains SMTP:user@contoso.com and smtp:user@contoso.onmicrosoft.com

If missing: Directory sync lag or attribute not synced. Force sync and wait 15 minutes.

Step 5: Test HTTPS connectivity

From on-premises server (with internet access):

Test-OrganizationRelationship -UserIdentity user@contoso.onmicrosoft.com -Verbose

Expected: Returns URI and availability data

If 403 or timeout: Firewall, certificate, or cloud endpoint issue. Go to remediation.

Step 6: Verify firewall lookups

Common cloud free-busy URLs:

https://service.exchangelabs.com/EWS/Exchange.asmx (global default)
https://outlook.office365.com/EWS/Exchange.asmx (EXO-specific)

Test from on-prem with:

Invoke-WebRequest -Uri https://service.exchangelabs.com/EWS/Exchange.asmx -UseBasicParsing

If timeout/403: Firewall rule needed. See remediation.

Root Cause Patterns & Frequency

Root cause patterns for free/busy failures with evidence, fixes, and frequency
Root Cause Evidence Fix Frequency
Directory sync incomplete Get-User shows RemoteUserMailbox; proxyAddresses empty Force directory sync; wait 15m for attributes to populate 38%
Firewall blocks cloud free-busy URL Test-OrganizationRelationship returns 403/timeout; Test-WebRequest fails Add firewall rule for service.exchangelabs.com:443 32%
Organization relationship not configured Get-OrganizationRelationship returns empty; no free-busy URLs Run HCW or manually add org relationship with cloud free-busy URL 18%
Certificate mismatch on free-busy URL 443 connection works but SSL cert doesn't match domain Update organization relationship with correct free-busy URL 9%
Hybrid connector misconfigured Test-MserviceConnection fails; connector not routing to EXO Re-run HCW to reconfigure connector; restart transport service 3%

Safe Remediation Procedures

Procedure 1: Force Directory Sync and Wait (Low Risk)

Purpose: Ensure all mailbox attributes are synced to cloud before testing free-busy.

Pre-check:

Get-User user | Select RecipientType, PrimarySmtpAddress

Steps (on-premises):

  1. Force directory sync: 
    Start-ADSyncSyncCycle -PolicyType Delta
  2. Wait 15 minutes for sync to complete.
  3. Verify user's cloud mailbox now has correct SMTP addresses: 
    Get-User user | Select PrimarySmtpAddress

Rollback: No rollback needed; data sync is one-way from on-premises.

Procedure 2: Add Firewall Rule for Free-Busy URL (Low Risk)

Purpose: Allow HTTPS lookups from on-premises to cloud free-busy endpoint.

Pre-check: Test current connectivity: 

Test-NetConnection -ComputerName service.exchangelabs.com -Port 443

If timeout/refused: Firewall rule likely missing.

Steps (firewall admin):

  1. Add outbound rule: Destination = service.exchangelabs.com, Port = 443, Protocol = HTTPS
  2. Add secondary rule for outlook.office365.com:443 (regional failover)
  3. Test from on-premises server: 
    Test-OrganizationRelationship -UserIdentity user@contoso.onmicrosoft.com

Rollback: Remove firewall rules; restore to previous state.

Procedure 3: Recreate Organization Relationship (Medium Risk - Requires CAB)

Purpose: Regenerate trust and free-busy URL configuration between on-premises and cloud.

Pre-check:

Get-OrganizationRelationship | Select DomainNames, FreeBusyAccessEnabled, FreeBusyAccessLevel

If empty or broken: Proceed to Step 1.

Steps (on-premises Exchange):

  1. Export current config (backup): 
    Get-OrganizationRelationship | Export-Clixml -Path C:\OrgRel_Backup.xml
  2. Remove old relationship: 
    Remove-OrganizationRelationship -Identity "Microsoft Exchange Online" -Confirm:$false
  3. Re-run Hybrid Configuration Wizard (HCW) to regenerate. Choose "Free-Busy Sharing" in wizard.
  4. Verify new configuration: 
    Get-OrganizationRelationship | Select FreeBusyAccessLevel, TargetSharingEpr
  5. Test: 
    Test-OrganizationRelationship -UserIdentity user@contoso.onmicrosoft.com

Rollback: If test fails, restore from backup: 

Import-Clixml -Path C:\OrgRel_Backup.xml | New-OrganizationRelationship

Procedure 4: Fix Mailbox Proxy Addresses (Low Risk)

Purpose: Ensure remote mailbox has all required SMTP address mappings.

Pre-check:

Get-RemoteMailbox user | Select PrimarySmtpAddress, @{N="ProxyAddresses";E={$_.ProxyAddresses}}

Steps (on-premises):

  1. Add missing SMTP address: 
    Set-RemoteMailbox user -EmailAddresses @{Add="smtp:user@contoso.com"}
  2. Force sync to cloud: 
    Start-ADSyncSyncCycle -PolicyType Delta
  3. Verify in cloud: 
    Get-User user | Select PrimarySmtpAddress

Rollback: Remove address: Set-RemoteMailbox user -EmailAddresses @{Remove="smtp:user@contoso.com"}

Procedure 5: Test Free-Busy from Client (Validation)

Purpose: Confirm end-user free-busy lookup now works.

Steps (on-premises Outlook user):

  1. Open Outlook calendar.
  2. Invite cloud user to test meeting (Ctrl+N, add email, click "Scheduling").
  3. Verify availability grid shows busy blocks, not all free.
  4. If successful, cancel meeting (no send).

If still all free: Return to Step 4 in diagnostic tree.

Escalation Criteria

  • When to escalate to Microsoft: If directory sync completed, firewall allows free-busy URLs, org relationship configured, but Test-OrganizationRelationship still returns errors—cloud endpoint issue. Contact Microsoft Support with Test-Org output.
  • When to escalate to network team: If firewall rule cannot be added (policy/approval blocker) or fails to allow traffic even after addition—escalate for network troubleshooting.
  • When to escalate to identity team: If Azure AD Connect not syncing mail attributes despite force cycle—escalate to Azure AD sync admins.

Frequently Asked Questions

Why do free/busy lookups show all time as free?

Usually the organizational relationship is misconfigured or HTTPS lookups to the cloud endpoint are blocked by firewall.

Does directory sync affect free/busy?

Yes. Missing proxyAddresses or RemoteUserMailbox status often break cross‑forest availability.

Which URLs must be allowed for cloud lookups?

service.exchangelabs.com and outlook.office365.com over HTTPS 443.

🛡️ How to Prevent Free/Busy Failures

Regular hybrid health checks catch federation and directory sync issues before users report broken calendar sharing:

Weekly Hybrid Health Checks

  • Federation trust validation: Run Test-FederationTrust -UserIdentity testuser@domain.com weekly; alert on failures
  • Organization relationship test: Get-OrganizationRelationship | Test-OrganizationRelationship validates free/busy endpoint reachability
  • Directory sync monitoring: Check LastSyncSuccess timestamp daily; alert if > 4 hours old (sync stalled)
  • OAuth token validation: Verify Get-PartnerApplication shows enabled OAuth; expired tokens break modern auth lookups

Configuration Drift Prevention

  • Firewall rule audits: Quarterly review of HTTPS 443 allow rules for *.outlook.office365.com and *.exchangelabs.com
  • HCW re-run protection: Document current hybrid config before running HCW updates (prevent accidental overwrites)
  • Namespace consistency: Alert on Autodiscover DNS changes; free/busy relies on stable namespace resolution
  • Test mailbox validation: Maintain test mailboxes in both on-prem and cloud; validate cross-forest free/busy monthly

Automated Health Check Script (PowerShell)

# Run daily via scheduled task $OnPremUser = "testuser@onprem.local" $CloudUser = "testuser@tenant.onmicrosoft.com" $TestResult = Test-FederationTrust -UserIdentity $OnPremUser if ($TestResult.Type -ne "Success") { Send-MailMessage -To "exchange-admins@company.com" -Subject "Hybrid free/busy health check FAILED" -Body $TestResult.Description }

Recommended frequency: Daily during business hours; catch issues before user escalations.

Related Guides