[Office 365] Signing into apps fails, but doesn't? Device authentication failed?

[Garacesh]

Edit: Dunno why the attachments aren't showing, but they do work if you click them.

 

Azure AD Connect synchronises users, we've all seen this part of the story before so I'll skip it.

 

When I try to log in to Office applications, e.g. OneNote, with my test user, I get the following:

[ATTACH=CONFIG]59232[/ATTACH]

 

I don't even get as far as the password box, stick in the e-mail address and, nope!

 

If I try to log in as me, my admin account, I get through fine, no mess, no fuss. Same computer, same console session as the test user, only difference is the credentials I'm supplying to OneNote.

 

Office 365 recognises the bad sign in..

[ATTACH=CONFIG]59233[/ATTACH]

 

If I check the sign in event in Azure AD, I get the following:

Status: Failure

Sign-in error code: 50155

Failure reason: Device authentication failed.

 

But why would the device matter? We've never synchronised devices*? I don't care what device the user is using, so long as they authenticate properly?

The only difference I can see between my account and my test user, besides the admin privileges, is that regular users aren't licensed for Exchange, Kaizala, StaffHub or Yammer, and surely none of those are the issue?

 

* Unless maybe it happened by accident when AzureADC was being set up and now it's mucked everything up?

Edit3: Okay, so it turns out there are a few of our machines in Azure AD, but there's also a tonne of not-our-machines - including phones, so my guess is it's just throwing in every PC anyone's ever logged into a 365 account with?

 

Edit2: As for the 'but doesn't?' part, one time I still go the same error as my test user, but this was after providing a password, and it let me in. but upon running through it a few more times, it turns out most of the time it doesn't even let me put a password in, though.

Edited September 25, 2020 by Garacesh

[bald_pig]

"invalid attachment specified" for the images...

[Garacesh]

Wut.. I click 'em, they work for me O.o

 

Attachment 1:

 

Attachment 2:

[bald_pig]

They're back and showing now

[Steve21]

Sounds like someone activated for devices to register in Azure, deleted them but didn't clean up the task on the machine that tries to reactivate it?

 

Try dsregcmd.exe /debug /leave on one of the dud machines, give it a reboot and see if it resolves it

 

Steve

[Garacesh]

Sounds like someone activated for devices to register in Azure, deleted them but didn't clean up the task on the machine that tries to reactivate it?

I don't think I did, but how would one deactivate this setting?

For example, I've just freshly imaged a machine. It is not showing up in Azure's device list. My test user still can't log in.

(Although the error has now disappeared, and you put your password in, it looks fine, the login box goes away, and... nothing, you're still signed out)