Login popups for Migrated o365 users

[Geoff]

Hi everyone,

 

I have an annoying issue when I migrate my users from on prem to o365. They get constant login popups in outlook and SfB does not auto login like it does on prem. Is there any way round this. My enviroment is:

 

Server 2016 Citrix VDA w/FSLogix.

O365 current branch

Hybrid Exchange 2016

Hybrid Lync 2013

AADConnect for AAD Sync.

No ADFS.

O365 E3 + Enterprise/Security E3 (Everyone has MFA - Tested with MFA disabled though without success).

[azc]

Skype For Business relies on a SIP setting in the user's proxyAddresses AD attribute being present for SSO to work.

 

eg.

sip:[email protected] in the proxyAddresses attribute for each user.

 

The following article describes the issue and how to resolve it by running a powershell script to populate each user with the desired setting:

https://community.spiceworks.com/topic/1763422-skype-for-business-and-sso

[DJ-1701]

Just be careful with this... I noticed it knocked out some of my custom smtp and SMTP (default) entries as well.

[FN-GM]

Have you got modern authentication enabled?

 

When you say Skype isn't auto logging on - is that because the email address isn't auto populating or is it prompting for the password?

[rich_tech]

They using an app password because your using mfa?

[Geoff]

Yes. I have the proxyaddress set. It matches the email address (note my UPNs are different, does that matter?). Lync fills in the email address and prompts for a password.

 

Modern authentication isn't on as I do not meet the pre-reqs. I don't have Lync 2015.

 

I turned on app passwords. However I've been testing with non-mfa users too with the same issue, plus I am using office365 current branch so I am not sure how that is relevant.

Edited July 30, 2019 by Geoff

[chaplic]

*Seamless* Single Sign On will give you a smother sign in experience but are you randomly getting password pop ups when you don't expect it? in which case that needs fixed first.

 

Could it be autodiscover calling a website that's not an autodiscover website and that website, or a proxy inline, asking for a U+p?

[Geoff]

I've bypassed all the proxying and content inspection for this host. The same popups also occur on an off network PC connected directly to the Internet so I don't think it's that.