Office 365 pupils can't login after domain and forset functional change? (not ADFS)

[chazzy2501]

Pupils can no longer login to office 365 (we do not use ADFS, just password sync) When any pupil goes to the office.com website then presses sign in, then starts to type their email address the page suddenly re-directs and fails? The page it goes to is http://www.odwebbp.svc.ms/share.

 

The only change made to the system was yesterday, I finally got the domain and forest functional level to Windows 2008R2 (from 2003) I'm on my way to 2012R2:)

 

I can't attribute any other change that might cause this.. Ideas?

[mavhc]

If you're using Azure AD Connect, start there, there's lots of ways to get more logs and details out of it. Does the online admin page say it's still syncing?

[chazzy2501]

yes, still syncing (10 minutes ago)

[mavhc]

Start a support case with them, they're quite good at finding the problem

[chazzy2501]

ok, its only affecting pupil logins... office.com / sign in button. Then the credentials page opens (or pick an account) if you wait 3 seconds it re-directs you to the "www.odwebbp.svc.ms/share" page. I've talked to office365 support and they have no idea what that link is! (ms technical support fail)

 

I'm pretty sure it's a onedrive thing but onedrive is disabled for pupils! (probably this + functional change) as ms are useless I'll have to just hammer permutation of office settings until the pupil accounts obey.

[mavhc]

How does it know they're a pupil before they've logged in?

[chazzy2501]

it shouldn't know, I don't use roaming profiles. The pupils do have different GPOs and one of these combined with the domain functional change has caused this. I now know that the issue only occurs in Edge, ye olde internet explorer 11 doesn't redirect. I can now focus on Edge settings.

 

EDIT: include an image as it has an icon on the empty page.

 

Edited October 17, 2019 by chazzy2501

[pete]

Have you got SSO (Enable single sign on) ticked in AAD Connect?

 

If a pupil visits https://outlook.office.com/owa/school.region.sch.uk (adjust for your domain) does it work or do you get a better error?

 

As noted above, what do pupils do differently from staff when accessing Office 365?

[chazzy2501]

pupils really do nothing, the only difference is the user GPO applied to them. (hide drives, map folders, etc. The edge stuff was disable developer tools and don't allow changing the search provider) nothing too ominous.

 

I've found the link, it loads as you sign in, its a network location that opens a connection (in ie11 it stays open) I'm wondering if edge is doing something dumb with it. (some of the faster pupils can log in if they get their details in fast enough:)

 

I've checked the edge settings for pupils and I can't see a setting that would cause this.

[chazzy2501]

@pete , I don't see a SSO option on the sync tool, I looked at the configuration and nothing there that says SSO. The link you provided helps, it doesn't auto direct to the useless page! I was on call with Microsoft yesterday for an hour and they've never seen anything like it.

[mavhc]

Try with Chrome? I use this https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso so when they're in school if they go to the login page they're auto logged in anyway. Had to disable it once a few years ago for a bit, but it's been working great for ages.

[pete]

@pete , I don't see a SSO option on the sync tool, I looked at the configuration and nothing there that says SSO.

 

We're on AAD Connect 1.4.18.0 and I see the following (note this is enabled for us):