I can only confirm that also, we were unable to open up a similar autodiscover behavior in our network environment with outlook 2010 – 2019. As well, we checked the connection logs from our outlook programs on firewalls. We did not find any trace of connection with the domains autodiscover.com or autodiscover.pl in our case. We also tested some mobile clients, here also no traces of the “back-off” procedure.

I think that autodiscover “back-off” could be just a big fake and rumour 🙂

Regards,
IT Specialist

Yep. But we don’t know if the Outlook client is connected to Exchange Online or on-premises. We also don’t know the configuration of the Outlook client (what add-ins are loaded and if those add-ins might use EWS to interact with Autodiscover). We also don’t know the repro steps. i.e. is this something an average user might do or is it something that you need to take very precise steps in a certain order with a specific software configuration…

Well, we’ll see when they reveal the data they have and the mechanisms used to capture the information…

Probably someone just looking for their 15 minutes of fame.

And 16.0.9029 in another screenshot

(Windows+NT+10.0;+Microsoft+Outlook+16.0.13901;+Pro)
https://www.guardicore.com/labs/autodiscovering-the-great-leak/

The interesting thing here is that your finding might point to a flaw in EWS that has been incorporated into third-party products (like Outlook add-ins, and indeed, some Outlook components) to create the issue. I am going to contact Microsoft to advise them of this and we’ll see what they say (probably a response that they’re checking things out).

I worked backwards. I simply thought: how can such a request be created.

I suspect the domain information was deduced from the ip address of the request.

So the problem seems to be:
user enters a false mail domain
you own the mail domain
you have the credentials of the user (if the user uses basic authentication)

I like to think the best of everyone, but the lack of detail in the article is just so disappointing in terms of understanding what’s really going on here.

That’s interesting… how did you discover that very important point?