How to Redirect OWA to HTTPS in Exchange 2016 (Step-by-Step Guide)

How to Redirect OWA to HTTPS in Exchange 2016 (Step-by-Step Guide)

By default, Exchange Server 2016 doesn't automatically redirect requests to http://mail.contoso.com or https://mail.contoso.com toward the Outlook Web App login page. Instead, users have to manually type the full /owa path to reach it. If a user visits the root domain without it, or lands on the wrong protocol, they'll typically hit an error instead of the OWA login screen.

Configuring an HTTP-to-HTTPS redirect on the Default Web Site fixes this, so that any request — regardless of protocol or missing path — lands cleanly on https://mail.contoso.com/owa. This guide walks through the full process in IIS Manager, along with the reference table of default settings you'll need to restore afterward.

Before You Start

You'll need administrative access to the Exchange 2016 server and to IIS Manager. The process involves four main phases:

1. Temporarily disabling Require SSL on the Default Web Site
2. Re-enabling Require SSL on each virtual directory that needs it
3. Setting up the HTTP Redirect rule at the site level
4. Removing the inherited redirect from each virtual directory so only the root site redirects

Step 1: Disable Require SSL on the Default Web Site

1. Open IIS Manager on the Exchange server. On Windows Server 2012 or later, press Windows key + Q, type inetmgr, and open Internet Information Services (IIS) Manager.
2. In the left pane, expand the server, then expand Sites.
3. Select Default Web Site, and confirm Features View is active at the bottom of the window.
4. In the IIS section, double-click SSL Settings.
5. Clear the Require SSL checkbox, then click Apply in the Actions pane on the right.

This step is necessary because the redirect rule you'll configure next needs to apply at the site root — and the root can't have Require SSL active while you set that up.

Step 2: Restore Require SSL on the Individual Virtual Directories

Turning off Require SSL at the site level also turns it off for every virtual directory underneath it. You'll need to manually turn it back on for each directory that requires it by default.

1. In IIS Manager, expand the server, then Sites, then Default Web Site.
2. Select a virtual directory, and confirm Features View is active.
3. In the IIS section, double-click SSL Settings.
4. Select Require SSL, then click Apply.
5. Repeat this for every virtual directory in the Default Web Site that had Require SSL enabled by default — with the exception of /owa, which you'll leave alone. The only directories that don't require SSL by default are /IES, /PowerShell, and /Rpc — skip those as well.

Step 3: Configure the HTTP Redirect Rule

Now you'll set the actual redirect destination at the site level.

1. In IIS Manager, expand the server and Sites.
2. Select Default Web Site, and confirm Features View is active.
3. In the IIS section, double-click HTTP Redirect.
4. Configure the following:
   • Check Redirect requests to this destination, and enter https://mail.contoso.com/owa (replace with your actual domain).
   • Under Redirect Behavior, check Only redirect requests to content in this directory (not subdirectories).
   • Confirm the Status code is set to Found (302).
5. Click Apply in the Actions pane.

Step 4: Remove the Inherited Redirect from Each Virtual Directory

Because IIS settings cascade downward, the redirect rule you just applied will now affect every virtual directory too — which isn't what you want, since directories like /ecp, /EWS, and /Microsoft-Server-ActiveSync need to keep functioning normally rather than redirecting to /owa.

1. In IIS Manager, expand the server, Sites, and Default Web Site.
2. Select a virtual directory, and confirm Features View is active.
3. In the IIS section, double-click HTTP Redirect.
4. Clear both Redirect requests to this destination and Only redirect requests to content in this directory (not subdirectories).
5. Click Apply.
6. Repeat for every virtual directory under the Default Web Site.

Step 5: Restart IIS

In IIS Manager, select the server in the left pane, then click Restart in the Actions pane to apply all changes.

Default SSL and Redirect Settings Reference (Exchange 2016)

Use this table to double-check your configuration matches Microsoft's defaults once you're done:

Testing the Redirect

Once IIS has restarted, test each of the following URLs (substituting your own domain):

• http://mail.contoso.com
• https://mail.contoso.com
• http://mail.contoso.com/owa

All three should land on https://mail.contoso.com/owa. If any of them don't redirect correctly, double check that:

• The redirect rule at the site root points to the correct OWA URL
• Every virtual directory has had its own HTTP Redirect settings cleared (Step 4)
• Require SSL has been correctly restored on the appropriate virtual directories (Step 2)
• IIS has actually been restarted after your changes

Common Pitfalls

• Forgetting to restore Require SSL on virtual directories after Step 1 — this can leave directories accessible over plain HTTP, which is a security gap you don't want.
• Leaving the redirect active on subdirectories like /ecp or /EWS — these need to function on their own, not redirect users to /owa.
• Skipping the IIS restart — changes made in IIS Manager sometimes won't take effect until the service is restarted.