Restrict access to unpublished directories in Exchange

I assume you have a separate HTTP and HTTP VS. Just have you HTTP vip doing a 301 redirect to https://[HTTP::host][HTTP::uri] then you can use an iRule like this on your HTTPS VS to restrict access to you defined allowed paths. All paths will be blocked that are not in the switch command.

when HTTP_REQUEST {
    switch -glob [string tolower [HTTP::path]] {
        "/" {
            HTTP::respond 301 noserver "https://[HTTP::host]/owa"
        }
        "/autodiscover" {
            HTTP::respond 301 no server "https://[HTTP::host]/autodiscover/autodiscover.xml"
        }
        "/oab*" -
        "/esw*" -
        "/rpc*" -
        "/cvwebrecall*" -
        "/owa*" {
            return
        }
        default {
            reject
        }
    }
}