The scenario is a mixed environment Exchange 2010 and Exchange 2007.

ISA / TMG is publishing 2 URLs.

One URL mail.corp.com for OWA redirecting to the Exchange 2010 CAS Server (Integrated authentication enabled on CAS)

Second URL Legacy.corp.com for Exchange 2007 CAS server (Integrated Authentication enabled on CAS)

The problem was with the Android devices trying to sync with exchange 2007 through exchange 2010 (Android mobile phones are unable to get redirected to the 2007 server from the 2010)

A workaround usually used was manually changing the server URL from mail.corp.com (pointing to Exchange 2010 CAS) to Legacy.corp.com (pointing to Exchange 2007 CAS) on the android devices only (all other devices working fine – WP & IPhone)

A new workaround solves this issue and makes it possible to migrate from Exchange 2007 to Exchange 2010 without any need for manual changes on Android devices

Though Exchange 2007 and Exchange 2010 are in same AD site, workaround is to use "Proxy" feature.

This is possible due to presence of folder "Proxy" under ActiveSync virtual directory on Exchange 2007 CAS server.

On Exchange 2007 CAS server enable integrated authentication only on "Proxy" folder and remove external URL from the Exchange ActiveSync Virtual directory using Exchange Management Console.

Thanks to Israel Gofman a Microsoft PFE for a good technical session

Idan Plotnik

Identity and Security Engineer

Forefront MVP