Exchange Server AD FS Modern Authentication: Expanded Outlook client support

We tested this against a pure on-premises Exchange Server SE deployment with AD FS as the STS, no Entra ID, no directory synchronisation and no hybrid configuration, and wanted to share the result in case it is useful to others.

Outlook for iOS and Outlook for Android both authenticate successfully through AD FS, including multi-factor authentication. AD FS issues tokens with a Success result and logs no errors. Neither client then contacts Exchange again. No ActiveSync request is ever made, and the app returns to the Add Account screen without displaying any error.

The two clients fail in different places, which we think is the useful detail:

- Outlook for iOS requests a token only for the autodiscover resource, and never for the mailbox resource.

- Outlook for Android does request and receive a valid mailbox token with MFA performed, and still makes no ActiveSync request.

So the cause does not appear to be token issuance or relying-party configuration.

Controls on the same server and the same day: classic Outlook for Windows opens a live mailbox over MAPI/HTTP, and the native iOS Mail app runs a live ActiveSync session using a mailbox token from the same AD FS, on the same iPhone, about 80 seconds after Outlook for iOS failed. Our AD FS application group, redirect URIs and all twelve scopes match the documentation exactly, including the "Update the existing ADFS Outlook Application Group" section.

One documentation question: the supported clients table lists Outlook for iOS and Android as supported, while the "Effect on other clients" table in the same article still states that both fall back to Basic auth. Could those two be reconciled?

We have opened support case 2609220050003524 with the full AD FS and IIS logs, a screen recording of the client, and a frame-by-frame correlation between the two. Happy to provide test environment access if it would help reproduce this.