IMAP is not working correctly on Outlook Office365. Error: "User is authenticated but not connected"

Hi All,

In case anybody has trouble with the same problem. I share my results.

First of all the Microsoft payed support was not really willing to help although one of they payed services is not working correctly. I had to constantly prove that the problem is on server side. They were also not willing to give much information.

However after a couple of escalation rounds I find the following:

There is an IMAP Policy in place, which banns or restricts users if they behave "badly". What they check and what are the limits is for some insane reasons not public. However I managed to get the information that they check something similar -- but not fully the same -- as "Set-ThrottlingPolicy" function (which is on on-premise servers)

https://docs.microsoft.com/en-us/powershell/module/exchange/server-health-and-performance/set-throttlingpolicy

In my case IMAPMaxConcurrency limit was hit according to the support. Based on my measurements this limit is 15. My clients use only 1-1 connection which means I could not have reached the limit.

As further testing on my side, I have found that the server does not have dead connection detection. Which results that if I am using mobile internet and the phone switches between cells, it gets a new IP address, the old TCP connections are on server side open, but otherwise dead (half open connection). So the server thinks that I have reached the limit.

The Idle Timeout for the TCP connections is around 20 minutes. So I can do nothing till 20 minutes if I hit the limit.

Usually all industrial standard IMAP servers have "dead connection detection" which means that the server sends a NOOP (no operation) every ~2 minutes down to client, and if it does arrives it closes the dead connection.

Unfortunately Microsoft Exchange Server does not have such feature according to the support.

Workaround possibilities:

• You should reduce the number of connections to the server in you client. (This can be done in Thunderbird, and in most clients). This helps to reach the limit later, or not reach the limit at all.
• If you are using mobile internet as I do, you can try what I am doing. I have created an IMAP Proxy server on my own server, which is on a fixed internet line, and implemented a dead connection detection algorithm. So basically the functionality what is missing from Microsoft...(there are a couple of such proxies available on the internet, but I tried an own solution in our company)

I hope that helps.

Regards,

Robert

Hi Artur,

Did you got some information to your ticket? I am still struggling with the support.

The public support here was more willing to help than the Office 365 Ambassador which I am in contact with...

Regards,

Robert

Hi Artur,

Just as information for you. I got some answer from the ticket. But I have to start from scratch, to get to somebody who understands the Office365 cloud system. I think I am at some kind of first level support. And they want to validate my client settings (via screenshots), however I have sent them the OpenSSL logs which clearly shows that it is not client dependent.

Hopefully there will be some answers later on.

Regards,

Robert

Hello Galambos,

I have replied you via private message. Please check your PM. 

Regards,

Rick

I've been asked to open a ticket via office 365 center. I honestly am not sure why this suggestion is so private as to not post it publicly here. In any way, this is going in circles as I expect get the same amount of attention to this issue as you did and I a assume your ticket is still there lying dormant. 

If this is the backend issue, then why not just be transparent, have some place for all the people that have this issue (and there are many, enough to google to see) to track the progress or even help with testing.

Best,

A