OneDrive and Office

[clareq]

Anyone else having problems with users accessing OneDrive from Office? OneDrive seamlessly logs them on at log on, it shows up in File Explorer, can be navigated to online, but when trying to save a Word document to One Drive they get prompted to log on, and then get told their school address isn't recognised as a Microsoft account. Strangely, it's not affecting everyone.

[clareq]

I think I have things a bit clearer now - we have an internal and public domain, called, for example domainA. A few years ago the powers to be decided that @DomAinA wasn't a nice e-mail address, and told us to change it to @DomAinB. We created the new domain, registered it with 365, and all new users since then have been given the e-mail address @DomAinB. At the same time, all new accounts have the username @DomAinB. We have ADFS, and they are seamlessly logged onto 365. However, it appears that all users without a @DomAinA address aren't seamlessly connecting to OneDrive from Office. I'm sure it's something simple, and it's strange it's taken 2 years for anyone to notice, but has anyone got any ideas what I've missed?

[chaplic]

Yep.

 

MS constantly ask for 'email address' but they actually mean UserPrincipalName. Did you change the users userprincipalname too? This is the right thing to do, but be aware doing so breaks sync for those users, and also the onedrive client (all office products) need their profile re-set-up.

[clareq]

All uses with the domainB address have a domainB UPN. They will have never had a domainA UPN, so their profile won't be affected.

[chaplic]

Oh, I see. Have you setup any specific claims rule in ADFS that refer to domain?

 

Is there any difference on clients SSO behaviour in going to https://your-adfs-server.com/adfs/ls/IdpInitiatedSignOn.aspx

[chrisjako]

I think this is due to the version of office you have installed the full version not the O365 click to run version which seamlessly signs them in

[clareq]

Oh, I see. Have you setup any specific claims rule in ADFS that refer to domain?

 

Is there any difference on clients SSO behaviour in going to https://your-adfs-server.com/adfs/ls/IdpInitiatedSignOn.aspx

 

The ADFS was set up before my time here - where can I see what claims have been set?

 

I can't see any difference between clients going to that web site.