The HTTP request is unauthorized with client authentication scheme 'Negotiate'.

Question

The HTTP request is unauthorized with client authentication scheme 'Negotiate'.

nettech 181

Hi,

We are currently in a hybrid configuration E2019CU15 with O365, trying to migrate mailboxes to O365 we are seeing the error below on all mailboxes we are trying to migrate.

Error: CommunicationErrorTransientException: The call to https://owa.xyz.com/EWS/mrsproxy.svc failed. --> The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate, NTLM'. --> The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate, NTLM'.

Get-WebServicesVirtualDirectory | FL Identity,InternalAuthenticationMethods,ExternalAuthenticationMethods,MRSProxyEnabled

Identity : EXCH01\EWS (Default Web Site)

InternalAuthenticationMethods : {Ntlm, WindowsIntegrated, WSSecurity, OAuth}

ExternalAuthenticationMethods : {Ntlm, WindowsIntegrated, WSSecurity, OAuth}

MRSProxyEnabled : True

Get-WebServicesVirtualDirectory | FL Identity, MRSProxyEnabled Identity : EXCH01\EWS (Default Web Site) MRSProxyEnabled : True

Get-HybridConfiguration | FL Features

Features : {FreeBusy, MoveMailbox, Mailtips, MessageTracking, OwaRedirection, OnlineArchive, SecureMail, Photos}

Thank you!

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

5 answers

Answer 1

Same error here, also not solved by the IIS provider order or Windows Authentication settings.

The cause turned out to be how Exchange Online MRS handles endpoint credentials in DOMAIN\user format: it drops the domain on its data connection. Storing the credentials in UPN format ([email protected]) fixed it.

Full troubleshooting steps and the workaround: Hybrid Exchange 2019 to O365 mailbox migration failure

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 3

nettech 181

here is my current config
User's image

0 comments

Answer 4

Kudos-Ng 15,055 Microsoft External Staff Moderator

Hi nettech,

Thank you for posting your question in the Microsoft Q&A forum.

From your description, you’ve already reviewed the relevant MRS settings suggested by Q&A Assist and they look correct so the migration should work, but the error persists. Based on this older but still relevant thread: https://stackoverflow.com/questions/15570108/the-http-request-is-unauthorized-with-client-authentication-scheme-negotiate, the issue may be tied to the EWS authentication configuration in IIS.

Important: This link will take you to Stackoverflow, which is outside Microsoft’s domain. Please note that Microsoft is not responsible for the accuracy, security, or advertising on external sites.

Please open IIS Windows authentication > Providers… and verify that both Negotiate and NTLM are present. Then adjust the provider order (place NTLM at the top), restart IIS (iisreset), and test the migration again.

If the issue persists or you run into any difficulty with these settings, please update this thread and we can help you troubleshoot further.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

nettech 181 Reputation points

2026-02-06T15:47:26.3566667+00:00

This is what my IIS settings show. Does not match the settings posted in the forum you linked
Kudos-Ng 15,055 Reputation points Microsoft External Staff Moderator

2026-02-09T13:33:10.85+00:00
Hi nettech,

Thank you for providing the additional screenshots showing your IIS configuration.

Based on what I can see from your screenshots, it appears that Windows Authentication might be disabled while Anonymous Authentication is currently enabled on your EWS virtual directory.

Could you please confirm if you have tried the following steps:

Disable Anonymous Authentication

Enable Windows Authentication

Verify Windows Authentication Providers:

Right-click "Windows Authentication" again and select "Providers..."

Verify that BOTH (Negotiate, NTLM) providers are present in the list.

If either is missing, click "Add..." to add them

Restart IIS

Try running your mailbox migration again

Please let me know if you've already attempted these steps, or if you encounter any issues while performing them.
Kudos-Ng 15,055 Reputation points Microsoft External Staff Moderator

2026-02-10T10:49:48.59+00:00

Hi nettech,

Just checking in to see if you had a chance to review the previous response.

Your feedback would be very helpful in ensuring everything is on track.

Answer 5

The error message you are encountering, "The HTTP request is unauthorized with client authentication scheme 'Negotiate'", typically indicates an issue with the authentication settings for the Exchange Web Services (EWS) in your hybrid environment. Here are some steps you can take to troubleshoot and potentially resolve this issue:

Check MRSProxy Settings: Ensure that MRSProxy is enabled on all Client Access Servers (CAS) in your on-premises environment. You can verify this by running the following command:
```
   Get-WebServicesVirtualDirectory | FL Identity, MRSProxyEnabled
```
Make sure the MRSProxyEnabled parameter is set to True.
Authentication Methods: Review the authentication methods configured for the EWS virtual directory. You may need to adjust the ExternalAuthenticationMethods to ensure that they include methods that are compatible with your setup. You can set the authentication methods using:
```
   Set-WebServicesVirtualDirectory -Identity "EXCH01\EWS (Default Web Site)" -ExternalAuthenticationMethods Ntlm, WSSecurity, OAuth
```
Firewall and IDS Configuration: Ensure that your firewall and any Intrusion Detection Systems (IDS) are properly configured to allow EWS traffic without requiring pre-authentication. This is crucial for migration requests to go through successfully.
Hybrid Configuration: Verify that your hybrid configuration is set up correctly and that all necessary features are enabled. You can check this with:
```
   Get-HybridConfiguration | FL Features
```
Ensure that the MoveMailbox feature is listed.
ServiceModelReg Command: If the issue persists, you might want to run the ServiceModelReg.exe -r command to reinstall the handler mappings in IIS, which can sometimes resolve authentication issues.

If you continue to experience problems after these steps, consider consulting the Microsoft Community or Exchange TechNet Forums for further assistance.

References: