Forum Discussion

Stephen Bell's avatar
Stephen Bell
Iron Contributor
Dec 06, 2017

ADFS and SSO for Exchange Online

I hope this is the right spot for this post...

 

We have Office 365 E3 in our environment, setup using ADFS.  All of our email is in Exchange Online.

 

Because of this - when a user opens up MS Edge, and browses to https://outlook.office.com/ourdomain.dom they are *magically* auto-signed into their mailbox.  Who doesn't like magic :) ?

 

This is great for most of our users - however I have a small set of desktop computers that are shared workstations, with an auto-login, shared user account.  Because it is a shared workstation and shared user account - they do not have an email account.

 

I recently got a request to add a desktop shortcut to these machines for people to login to their exchange online mailbox via the web browser.  When I try to go to the login page I either get a failed to login error OR a loop to select my timezone.  I am guessing because the logged on user does not have a mailbox, and the ADFS is trying to perform SSO.

 

Any ideas how to get around this issue for these machines?

 

Thanks

Steve

 

 

Authentication
exchange
office 365
  • VasilMichev's avatar
    VasilMichev
    MVP
    Dec 06, 2017

    They are effectively logging in with the current windows credentials, as per the "magic" bit. Either disable the WIA auto-login in the browser options on those devices or remove the AD FS URL from the Intranet zone.

    • Nestori Syynimaa's avatar
      Nestori Syynimaa
      MVP
      Dec 08, 2017

      You can also alter the AD FS Claim Issuance Rules so that those devices  would be treated as externals (i.e. loggin in outside your internal network). That way they would be offered a login form instead of signing in automatically.

      • Stephen Bell's avatar
        Stephen Bell
        Iron Contributor
        Dec 27, 2017

        I am not sure how I would do this -- do you have an example of where you can link me to?

         

        Thanks

        Steve

    • Stephen Bell's avatar
      Stephen Bell
      Iron Contributor
      Dec 27, 2017

      I think I have this done -- 

       

      I removed our ADFS URL from the intranet zone, removed the internal DNS record that points to the inside of the ADFS environment.  I now ping from this client and get an external IP address.

       

      The WIA (or IWA? - I've seen it both ways??) - I went into IE on one of the clients, Security Tab --> Custom Level --> Login --> Prompt for user name and password.  

       

      Rebooted the PC 2 times and I am still getting auto login for my OWA url?  What am I missing?

       

      Thanks

      Steve

  • Brian Reid's avatar
    Brian Reid
    MVP
    Dec 21, 2017
    Or you can ask them to browse to the site via an InPrivate session in the browser, as that does not auto submit credentials

Resources