Hybrid Calendar Room Booking Failure After Exchange Online Migration
A medical device manufacturer runs Exchange 2019 on-premises for 5,200 mailboxes and Exchange Online for 1,300 migrated users in a full hybrid deployment. Webex Hybrid Calendar Service is enabled; one Calendar Connector is installed in Frankfurt and registered to Expressway-C. Room mailboxes (120) remain on-premises. The service account has Full Access permission on all room mailboxes but no ApplicationImpersonation role. On-prem users can schedule rooms in Webex App. Exchange Online users can schedule Webex meetings, but the room resource does not reserve; no NDR is returned. Room displays show “No meetings” after 10 minutes. EWS is enabled; Autodiscover for on-prem returns mail.contoso.com; Exchange Online uses outlook.office365.com. The connector logs show HTTP 403 for some mailboxes.
1. What is the most likely cause of Exchange Online organizers failing to book on-premises rooms, and what would you verify first?
Read the worked answer
The HTTP 403 and the service account's permission model point to an Exchange Web Services authorization problem rather than a Webex meeting defect. Full Access on room mailboxes is not the same as ApplicationImpersonation, which the Calendar Connector normally needs to access organizer and resource mailboxes. Verify first whether the service account has the ApplicationImpersonation management role scoped to the relevant mailbox scope, and whether the connector is configured to reach both Exchange on-premises and Exchange Online. A connector pointed only at mail.contoso.com will not process Exchange Online organizer mailboxes; a connector that reaches both must use the correct EWS endpoint and authentication for each.
Also check the EWS allow list, throttling policy, and whether the room mailbox is a resource mailbox with scheduling enabled. The absence of an NDR is consistent with the connector failing to process the request, not with Exchange rejecting it. Test with a single migrated organizer and one on-prem room, using EWS logs on both sides, before changing permissions globally.
2. Design the Exchange permission and connector model for the hybrid coexistence period.
Read the worked answer
Use dedicated service accounts and scoped impersonation, not Full Access on every room. In Exchange on-premises, create a service account and assign ApplicationImpersonation with a management scope covering the on-prem mailboxes and rooms the connector must process. In Exchange Online, create the equivalent service account and assign ApplicationImpersonation scoped to migrated users and any cloud rooms. Restrict the accounts to EWS access and document the scope; do not grant Organization Management.
For connector placement, verify whether the deployed Calendar Connector can service both environments. If it cannot, deploy a second connector for Exchange Online or configure the existing connector with both Exchange settings as supported. Keep Expressway connectivity healthy because the connector registers through Expressway-C. Apply a dedicated EWS throttling policy so room processing is not starved by user traffic. Test the model with one on-prem organizer, one cloud organizer, one on-prem room, and one cloud room to prove all four paths before scaling.
3. How would you troubleshoot the room displays showing “No meetings” after 10 minutes?
Read the worked answer
Separate display refresh from calendar processing. First confirm whether the room mailbox itself has the meeting: open the room calendar in Outlook or run Get-CalendarProcessing. If the meeting is present but the display is empty, the problem is the Webex room device, its resource association, time zone, or refresh interval, not Exchange. If the meeting is absent, focus on connector processing and permissions. Check the connector log for the room SMTP address, EWS response codes, and whether the organizer is on-prem or cloud. The 403s indicate some mailboxes are failing authorization, so scope the test to a failing room. Confirm the room mailbox is enabled for scheduling and that the meeting request is not being processed as an external message that the room rejects. Finally, verify the room resource in Control Hub is mapped to the correct mailbox and that the display is signed into the correct workspace; a wrong mapping produces a healthy mailbox with an empty display.