Outlook 2016, Hybrid Exchange 2013 password prompt

[_techie_]

Wondering if anyone can help with an odd issue.

We are now complete with Win 10 1809 LTSC rollout. We have rolled out Office 2016 in a hybrid exchange 2013 environment.

 

Issue occurs with login prompt when launching outlook after first login to Windows. It occurs only once but every time after login to Win 10.

 

To explain setup:

Exchange 2013 on latest CU.

 

Hybrid setup with O365 with mail filtering only on O365.

 

Win 10 (1809 and 1607). Login prompt on Outlook 2016 occurs on on- prem exchange.

 

ADFS 3.0 on 2012 R2, Azure AD connect on same box with SSO to O365 enabled.

 

Smoothwall UTM in place with port forward and firewall rules in place to allow mail between on premise and O365.

 

Our users email address and userPrincipalName match so I'm struggling to understand why this is happening.

 

Smoothwall isn't showing any problems when launching outlook both on Web filter or Firewall reports. I,m stumped! In credential manager the credential is showing as "session' which makes sense, but how do I make this seamless? I'm running outlook with cached mode off, and the group policy that says configure mail profile based on AD email address.

 

Any ideas?

Thanks

[RobD]

Hello,

 

Have the users been migrated to O365 or still on prem with the modern apps? Also are users static or roaming?

 

I've had something similar and it seemed to be with the auth method, you can try this reg setting:

 

 

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity

DisableADALatopWAMOverride

Dword: 1

 

Also make sure the credential manager is clear before starting Outlook and might be worth checking this out:

https://practical365.com/exchange-server/configure-hybrid-modern-authentication-for-exchange-server/

[_techie_]

On prem for 100% of users. Most users roaming, but it does affect those who don't with local profiles....

I'll give that reg key a whirl and see what gives.

[_techie_]

Gave that a go, but no joy...

[RobD]

Try and remove the otherone and try and force Office 2016 to only use basic Auth as a test:

 

HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Identity\

EnableADAL

 

dword value Set as 1

[_techie_]

Tried that one already. Didn't work!

[Netwacky87]

We had this prior to enabling SSO and migrating from ADFS to pass-through authentication. New first time users on a desktop would get a password prompt. 99.9% of users just learnt to enter their password.

 

Have you configured Modern Authentication on the exchange server? https://docs.microsoft.com/en-us/office365/enterprise/configure-exchange-server-for-hybrid-modern-authentication

 

Also, where is your autodiscover pointing to? on premise?

[_techie_]

Hi. Not yet enabled HMA on our on premise server... The Autodiscover is pointing at our on premise external facing URL, using a static DNS Alias. Our domain clients would look up our local DNS first. I have read that Microsoft article about HMA but was in two minds as to enable it or not. Frankly getting users to enter there password is not the end of the world!

[Netwacky87]

Frankly getting users to enter there password is not the end of the world!

 

Ours managed fairly quickly! Didn't really hear any moaning - sometimes the dialogue box goes behind outlook so they work offline before they realise they havent had any emails in a while!

[techy32]

We are facing the similar issue. We have just migrated to office 365, autodiscover points to office 365. As soon as we login to Windows 10 and open outlook it asks for a password. Any solution?

[chaplic]

Do you know, exactly, what you are using for auto discover (scp, autosdiscover.email.address, direct to O365 even if mailbox on prem) and could calling something unexpected cause the password problem?

 

Find Outlook in the bottom right, Ctrl and right click over it and select test email autoconfiguation. Untick the two guess options and don't put a password in. Look at the log pane - does the password prompt reappear and does it align with a particular call?

[techy32]

Do you know, exactly, what you are using for auto discover (scp, autosdiscover.email.address, direct to O365 even if mailbox on prem) and could calling something unexpected cause the password problem?

 

Find Outlook in the bottom right, Ctrl and right click over it and select test email autoconfiguation. Untick the two guess options and don't put a password in. Look at the log pane - does the password prompt reappear and does it align with a particular call?

 

We are using two addresses for autodiscover

 

1. Internal address: https://Outlook.offie365.com/owa

2. External address: https://Outlook.offie365.com/owa/SchoolName.xxx.sch.uk

 

I unticked both guess options and run the test, it didn't ask for a password. We have done very limited testing as we have just migrated so we have to wait and see how it goes when the staff return in September.....