Exchange server different API but functionnal about uhoh365

[Raikia]

If you give an example email set, I can test what you mean. If you'd like to privately share, send to [email protected]. Its hard to debug something like this generically because o365 has some absurd and irregular API responses

[Raikia]

Whoops didnt mean to close

[Raikia]

Spoke with @darcosion via email and the issue was that the domain wasn't configured for o365 and @darcosion misunderstood how this technique works. For someone who might find this in the future:

This is actually (unfortunately) part of how Exchange works. That “It doesn’t look like XYZ uses o365” print that UhOh365 displays is because of that redirect. If you look at how the requests work, here is a domain that does use o365:

If a domain doesn’t use o365, it redirects to the domain whether or not it exists at all. It doesn’t mean that it knows the API exists, it just redirects to it anyway. Like this:

So following the redirect there won’t be helpful because the majority of the time, that redirect will probably not actually exist.

The results UhOh365 reveal some different information:

• If the domain uses o365 (so it is like the first screenshot above), we can know if an email is valid or not
• If the domain does not use o365 (like the second screenshot), we can see if the email has a msft account (and thus is valid), but we cannot determine if the email doesn’t exist