Why can I connect mail through a mobile client?

Question

Outlook

Colleagues, welcome.
Tell me which way to dig, the problem is the following.
I assembled a laboratory stand for studying ms exchange 2016, made all the necessary settings, issued a 3-month certificate from an authorized CA. OWA works without problems from the external network, mail goes to Google mail and back without any hitches or problems.
But bad luck, I tried to connect mail via a mobile phone and I could not do it.
Gmail client after much thought gives a message that "No connection to the server" try again (very uninformative message).
Outlook mobile - seems to connect and does not swear at anything, but at one time it does not download letters, as if the box is empty.
Also noticed that:
1) if you go to the Mailbox property through the exch console in the "Information about the mobile device" there is empty, there is not a single connected device.
2) if you set the wrong password when connecting via Gmail, then it will immediately send and prompt you to enter the correct password.

How to be? What to do? Maybe not all ports are open, port 25 and 443 are forwarded on network equipment, as far as I understand, only port 443 is enough for mobile devices.

Answer 1

Yes, 443 ports is enough.
You can test here: https://testconnectivity.microsoft.com/tests/exchange
Select ActiveSync.

Answer 2

remove panic
learn logs
learn routing

Answer 3

Try checking IMAP. According to the description, the problem is there. Maybe it's configured incorrectly.

Answer 4

In fact, a common mistake is in the excess of granted rights to the user. That is, if you are a superadmin, then MS Exchange disables the inheritance of domain-wide rights and disables the right to synchronize folders for ActiveSync.
This article describes how to allow admins to use mobile native clients, but in my opinion it's better not to use "outside" superadmin accounts, but to redirect some mail to a "death user" account.

Answer 5

Most likely, the problem is that the Exchange server does not have enough rights to create objects in Active Directory.
If there are events with id 1053 in the log on the server, that's for sure.
https://docs.microsoft.com/en-us/exchange/troubles...