Quick answer: To send users who type mail.contoso.com or http://mail.contoso.com straight to https://mail.contoso.com/owa, configure IIS on each Exchange Mailbox server in four steps: remove Require SSL from the Default Web Site, put Require SSL back on the Exchange virtual directories, add an HTTP Redirect on the Default Web Site with Only redirect requests to content in this directory ticked, and remove the inherited redirect from every virtual directory. It works the same on Exchange 2016, Exchange 2019 and Exchange Server SE. Below are the IIS Manager steps and a one-shot PowerShell script.
Before you start
- Your OWA URL must already use a trusted SSL certificate (for example
mail.contoso.com). - Do this on every Mailbox server behind your load balancer, or users will get different results.
- Run IIS Manager or the commands as a local administrator. Take a note of any custom IIS changes you made before.
Default settings you are changing
| Default Web Site path | Require SSL by default |
|---|---|
| (site root) | Yes |
| API, aspnet_client, Autodiscover, ecp, EWS, mapi, Microsoft-Server-ActiveSync, OAB, owa | Yes |
| PowerShell, Rpc | No – leave them as they are |
No virtual directory has an HTTP redirect by default. After the change, only the site root redirects.
Option 1: IIS Manager (step by step)
Step 1: Remove Require SSL from the Default Web Site
- Open IIS Manager (
inetmgr), expand the server and Sites, and select Default Web Site. - Double-click SSL Settings, clear Require SSL, and click Apply.
Plain http:// requests can now reach the site root, which is what allows the redirect to catch them.
Step 2: Put Require SSL back on the Exchange virtual directories
For each of API, aspnet_client, Autodiscover, ecp, EWS, mapi, Microsoft-Server-ActiveSync, OAB and owa: select it, open SSL Settings, tick Require SSL, and click Apply. Leave PowerShell and Rpc without Require SSL.
Step 3: Add the redirect on the Default Web Site
- Select Default Web Site and double-click HTTP Redirect.
- Tick Redirect requests to this destination and enter
https://mail.contoso.com/owa(your own OWA URL). - Tick Only redirect requests to content in this directory (not subdirectories).
- Leave Status code as Found (302) and click Apply.
Do not skip the “Only redirect requests to content in this directory” box. Without it, Outlook, ActiveSync phones and Autodiscover are redirected to /owa and stop working.
Step 4: Remove the inherited redirect from every virtual directory
IIS copies the new redirect down to each virtual directory. For every virtual directory under Default Web Site (including PowerShell and Rpc): open HTTP Redirect, clear both check boxes, and click Apply.
Step 5: Restart IIS
net stop w3svc /y
net start w3svcOption 2: One PowerShell script (all steps)
Run in an elevated PowerShell window on each Mailbox server. Change the URL on the first line.
$owa = "https://mail.contoso.com/owa"
$appcmd = "$env:windir\system32\inetsrv\appcmd.exe"
$ssl = "API","aspnet_client","Autodiscover","ecp","EWS","mapi","Microsoft-Server-ActiveSync","OAB","owa"
$all = $ssl + "PowerShell","Rpc"
# 1. Remove Require SSL from the site root
& $appcmd set config "Default Web Site" -section:access -sslFlags:None -commit:APPHOST
# 2. Require SSL again on the Exchange virtual directories
foreach ($v in $ssl) { & $appcmd set config "Default Web Site/$v" -section:Access -sslFlags:"Ssl,Ssl128" -commit:APPHOST }
# 3. Redirect the site root to OWA (root only)
& $appcmd set config "Default Web Site" -section:httpredirect -enabled:true -destination:$owa -childOnly:true
# 4. Remove the inherited redirect from every virtual directory
foreach ($v in $all) { & $appcmd set config "Default Web Site/$v" -section:httpredirect -enabled:false -destination:"" -childOnly:false }
# 5. Restart IIS
net stop w3svc /y; net start w3svcTest the redirect
From any Windows 10/11 machine:
curl.exe -I http://mail.contoso.com
curl.exe -I https://mail.contoso.comBoth should return HTTP/1.1 302 with Location: https://mail.contoso.com/owa. Then check that nothing else broke: open Outlook desktop, sync a phone, and browse to https://mail.contoso.com/ecp (it must open the admin center, not OWA).
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| ECP, Outlook or phones land on /owa or loop | A virtual directory still has the redirect, or the “only this directory” box was not ticked | Repeat Step 3 and Step 4 |
http:// gives 403 “SSL required” | Require SSL is still on the site root | Repeat Step 1 |
| Redirect stopped working after an Exchange update | Cumulative/security updates can reset IIS settings | Run the script again after each update and test |
| Browser warns about the certificate | The name users type is not on the certificate | Add that name to the Exchange certificate, or redirect to the name on the certificate |
| Only some users get the redirect | Not configured on every Mailbox server | Run the script on all servers behind the load balancer |
Exchange 2013 and 2010
Exchange 2013 uses the same IIS steps. Exchange 2010 uses a different layout (Client Access servers, and /owa handled separately), so follow Microsoft's archived Exchange 2010 article. Both versions are out of support; the current on-premises version is Exchange Server Subscription Edition (SE).
FAQ
Should I use 301 or 302?
Microsoft's procedure uses Found (302). A 302 is safer: if you later change the OWA URL, browsers have not cached a permanent redirect.
Can I use the IIS URL Rewrite module instead?
Yes, but Microsoft does not document it for Exchange, and Exchange updates can conflict with extra rewrite rules. The built-in HTTP Redirect feature is the supported method.
Will this break Outlook or ActiveSync?
No, as long as the redirect is only on the site root (Step 3 box ticked) and removed from every virtual directory (Step 4).
Do I need to do this on the Edge Transport server?
No. Only Mailbox servers run the client access services and OWA.
Sources
- Microsoft Learn: Configure http to https redirection for Outlook on the web in Exchange Server
- Microsoft Learn (archive): Simplify the Outlook Web App URL in Exchange 2010
Related guides: Increase the attachment size limit in Exchange and Outlook · All Windows Server and Exchange guides
Thank you for your message.