Outlook autodiscover fails for new WorkMail mailboxes — points to wrong endpoint (autodiscover.mail.us-east-1.awsapps.com instead of autodiscover-service.mail.us-east-1.awsapps.com)

Would suggest to check on below at first place:

1. Force Outlook to use the correct endpoint • Add a registry key to disable SCP and legacy fallback:

[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover]
"ExcludeScpLookup"=dword:00000001
"ExcludeHttpsRootDomain"=dword:00000001
"ExcludeSrvRecord"=dword:00000001
"ExcludeExplicitO365Endpoint"=dword:00000001

This forces Outlook to use the autodiscover-service.mail.us-east-1.awsapps.com endpoint directly. 2. Verify DNS propagation • Confirm that your public DNS record for autodiscover.yourdomain.com is a CNAME pointing to:

autodiscover-service.mail.us-east-1.awsapps.com

• Use nslookup or dig from multiple locations to ensure global propagation. 3. Use Microsoft Remote Connectivity Analyzer • Run the Outlook Autodiscover test at testconnectivity.microsoft.com to verify endpoint behavior. • Look for any unexpected redirects or 600 errors. 4. Check SSL certificate trust • Ensure the SSL certificate for autodiscover-service.mail.us-east-1.awsapps.com is trusted by the client machine. • If using a proxy or firewall, confirm it doesn’t interfere with HTTPS traffic to AWS endpoints.

The issue you're experiencing with Outlook autodiscover for Amazon WorkMail appears to be related to how the AutoDiscover process works with multiple phases.

When Outlook attempts to configure a mailbox, it goes through several AutoDiscover phases:

1. Phase 1: An SCP lookup against local Active Directory (skipped if not domain-joined)
2. Phase 2: Sending requests to URLs like:

• https://company.tld/autodiscover/autodiscover.xml
• https://autodiscover.company.tld/autodiscover/autodiscover.xml

3. Phase 3: DNS lookup to autodiscover.company.tld and sending requests to the endpoint

The correct endpoint for US East (N. Virginia) region is indeed "autodiscover-service.mail.us-east-1.awsapps.com/autodiscover/autodiscover.xml" as per AWS documentation.

Since your older mailboxes are still working but new ones aren't, this suggests that Outlook might be caching the old endpoint information or there might be conflicting DNS records.

Here are some additional troubleshooting steps:

1. Ensure your DNS configuration is correctly set up for both Phase 2 and Phase 3 of the AutoDiscover process
2. Check if there are any old CNAME records pointing to the legacy endpoint that might be causing conflicts
3. Test the AutoDiscover endpoint configuration by making an unauthenticated POST request to verify it's working correctly
4. Consider setting up AutoDiscover Phase 2 manually using either Route53 and CloudFront or an Apache web server as described in AWS documentation
5. For affected users, try configuring Outlook manually with the correct Exchange Web Services (EWS) endpoint: https://ews.mail.us-east-1.awsapps.com/EWS/Exchange.asmx

If these steps don't resolve the issue, you may need to contact AWS Support for further assistance, as there could be a more complex problem with your WorkMail configuration.
Sources
Amazon WorkMail endpoints and quotas - AWS General Reference
Enabling AutoDiscover to configure endpoints - Amazon WorkMail