Detect with OSINT tool 
And carry out Server-Side Forgery attacks and inflict damage on the exchange server with Remote Code Execution 
Large majority exposed on port 80 and 443 

thanks for your afford

very good sharing thanks

If u want to scan some OWA domain or host with OWA, can do with NSA script http-vuln-exchange (download and copy nsa file(s) to dir /usr/share/nmap/scripts) and nmap

Example
When we find some mail server with OWA we can make scanning for vuln with this command.
sudo nmap --script http-vuln-exchange mail.example.com
If this server it's vuln u will see message "MS Exchange 2016 IS VULNERABILITY".