Outlook Unable to Connect to Office 365

[smarties11]

Hi All,

 

We migrated student mailboxes to Office365 last summer. We are intermittently seeing the error "We are unable to connect right now. Please check your network and try again later" when using the Outlook 365 client. It doesn't happen all the time, but when it does happen it appears to affect everyone.

 

A bit of context and troubleshooting I have followed so far...

 

- our students are members of the 'Guest Account' local group in order to keep profiles transient, i.e. local profiles are deleted at logoff

- therefore Outlook profile is configured every time they log on, when they open Outlook

- we use the setting in group policy to connect to the mailbox based on SMTP address in AD

- majority of staff are still on-prem, MX and autodiscover for our domain point to on-prem still at present i.e. we are running hybrid

 

The error we see is

 

 

If I look at the live logs on our filter (SmoothWall), I see a 302 redirect first at http://autodiscover.ourdomain.mail.onmicrosoft.com. Then, I see a 503 error for https://autodiscover.ourdomain.mail.onmicrosoft.com, and then another 503 error for https://ourdomain.mail.onmicrosoft.com (see below). In SmoothWall, we have Microsoft Office 365, Outlook and Outlook Access categories set to do not inspect and do not filter.

 

 

I came across this article on the SmoothWall KB (https://kb.smoothwall.com/hc/en-us/articles/360002136184-503-HTTP-code-error-while-trying-to-connect-Outlook-client-to-Office-365-s-configuration-URL) which says that Office 365 does not support HTTPS for autodiscover. Is that really correct in this day and age?

 

When this error happens, users also cannot connect to their OneDrive or SharePoint sites via any Microsoft 365 desktop app - with the same errors appearing in the SmoothWall log.

 

I was wondering if anyone else has had this issue and knows how to resolve? I'm not sure if this is a SmoothWall issue or a client issue, perhaps a bit of both. Should I be looking to bypass the SmoothWall for Office365 related domains in the proxy exceptions, which I think is MS preferred method?

[djm968]

List of Microsoft 365 Domains

https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

 

Also, I would just use Outlook online for student email, only a few staff here use the Outlook Desktop client, everyone else uses Outlook online.

[chaplic]

I think you're barking up the wrong tree here. Autodiscover can be responsible for a lot of ills (and tracing an autodiscover will show lots of errors even in perfect scenarios) but newish versions of Outlook just connect direct to O365 anyway

 

This is caused, I believe, by NCSI - windows is deciding your machines dont have internet access and office isn't even trying. Google Chrome will browse the web just fine. This is an absoloute nightmare to troubleshoot, sorry :-(

[Ex-MGSTech]

Have you tried this?

 

https://testconnectivity.microsoft.com/tests/o365

 

- - - Updated - - -

 

Have you tried this?

 

https://testconnectivity.microsoft.com/tests/o365

[smarties11]

I think you're barking up the wrong tree here. Autodiscover can be responsible for a lot of ills (and tracing an autodiscover will show lots of errors even in perfect scenarios) but newish versions of Outlook just connect direct to O365 anyway

 

This is caused, I believe, by NCSI - windows is deciding your machines dont have internet access and office isn't even trying. Google Chrome will browse the web just fine. This is an absoloute nightmare to troubleshoot, sorry :-(

 

I think you've hit the nail on the head here! As we sometimes also have issues where students tell us 'design ideas' templates don't work in Office Apps, and they'll often say the computer says 'no Internet'.

 

Looked back through my documentation and when we first deployed Windows 10 all those years ago, I set the GPO "Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings\Turn off Windows Network Connectivity Status Indicator active tests" to enabled. I think back then it wasn't relied on so much in apps, and I probably thought it was pointless. But reading about NCSI, it seems that active tests are the ones where it tries to connect to / DNS lookup / download .txt from the http://www.msftconnecttest.com domain. Obviously with these tests disabled in GPO, we are relying on the passive tests, which explains the pattern we say where it's OK for a while then suddenly not for everyone - the passive tests run less frequently, so when PCs are off over the weekend / hols etc the computers believe they have no Internet when powered back on, until tests run again.

 

Anyhow, I've found a machine that's not been on for a few days - sure enough Windows reports no Internet and Outlook fails to connect to O365. Reverted the GPO setting, gpupdate on client, pulled network cable and replugged to force the checks, and it works straight away. Will monitor over the next few days but think that's sorted it.

 

Thank you, thank you, thank you! I can't believe I missed this!

Edited June 13, 2022 by smarties11