Forum Discussion
Multi-factor Authentication breaks outlook
Just wondering if anyone has run into this issue.
I have been Turning on MFA for users a group at a time all was going smooth. The next morning after turning on MFA for the last hand full of users I had to force a password change company wide due to an internal issue. After doing this it caused outlook to start prompting only for the last hand full of users. No matter which password was entered it continued to prompt. I tried the domain credentials and i even popped in the app password as I read an article that mentioned this but this did not work for me. Just wondering if anyone has run into something similar or can shed any light that may have caused this issue while i wait for 2nd level support to call me.
44 Replies
- I had this issue just now. Problem was that the customer still used RPC instead of MAPI on-prem. Known issue it seems when migrating/connecting to EXO.
See: https://docs.microsoft.com/nl-nl/outlook/troubleshoot/authentication/outlook-prompt-password-modern-authentication-enabledHere is what works for me:
- Sign out of Microsoft products (word, onedrive, outlook)
- Erase all windows credentials from credentials manager
- Open Outlook to confirm the password prompt pops up. (do not enter it, exit Outlook)
- Turn on MFA entering the users cell phone
- Open outlook and paste in the newly created App Password
- Open word, excel, onedrive, teams etc entering the txt codes
I have had success going in that order. Any other way, and or any attemps at bulk enforcement all were met with problems.
Please be aware that Microsoft has announced that it is going to forbid App passwords (i.e. basic authentication) for clients accessing Outlook Web Services beginning in October of 2020. I've been testing Outlook on Android and there are currently many issues regarding 2-way, unattended, sync of contact information between Office 365 and Outlook App for Android. I've reported all of the issues I identified to Outlook App support, and they say they will address them. I'm also hoping that Android App providers like Samsung Mail App and Google Gmail App will be updated to support Modern Auth.
https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/Improving-Security-Together/ba-p/805892
Thanks to a post by Phillip Lyle on https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-auth-and-exchange-online-february-2020-update/ba-p/1191282, I discovered that Samsung Native Email App supports "Modern Auth". I'm running Version 6.1.11.6 on Android Pie.
You have to remove the existing "Basic Auth" account from the email app, and add it back by selecting "Office 365" type of account instead of "Exchange" type of account.
As you are doing this, the setup will prompt you with the Microsoft Modern Authentication dialogue box to log you in.
This will also re-create your calendars and contacts, so you might have to re-customize things like Calendar Color, Custom Ringtones (which are stored in the Contacts information), and Mail Signatures. You might want to check all of the settings in Calendar, Contacts, and Mail before removing the "Basic Auth" account instance.
Finally, when complete, you might want to delete the App password that you used to authenticate the "Basic Auth" account on Android from your Office 365 account. Then, if you use a device that you forgot had Basic Auth access to your Exchange Service, the login will be rejected and you can install a Modern Auth app on the forgotten device.
- Our issue was mainly with Outlook 2016 client on Windows 10. Long story short, Outlook was communicating to o365 using Modern Auth, but Basic auth. Ran MS SARA which was flicking a switch somewhere in the windows profile which addressed our issue. As far as the outlook app goes. I have pushed a modern Auth Mail Profile to Android and IOS using Itunes without issue.
Doing this the APP is now using the users network pass instead of the APP Password.Christian Taveras years later (though this thread was still active only a couple of months ago) I have one more potential culprits and an actual solution versus a work around/hack - for everyone's sake hopefully its the solution once and for all, as it should take you 5 minutes to make a single global change.
The solution came from continual link following from one of the replies above to Microsoft, back to other forums and in a loop but I pieced together the actual problem and was able to then find the solution. I figured I'd post this to help someone to cut to the chase versus having to following the same rabbit hole I did. I tried SaRA to no avail (just like with a couple of your tenants) and recreating the windows profile was the only solution that seemed reliable - not really an organization wide option.
I noticed, like you, I had a problem with some users, not all. I subsequently identified these users were all older tenants. I then found an article from Microsoft that said "For tenants created before August 1, 2017, modern authentication is turned off by default for Exchange Online and Skype for Business Online."
Essentially, try as you may with local options when your tenant attempts to authenticate with Exchange Online, O365 is forcing Outlook to use basic auth, not modern auth. So your "switch flicking" from SaRA did something server side not local or it changed something in the local registry that ignored O365 asking for Basic Auth. This could explain why registry hacks work. Andrios, iOS, and OSX applications only have modern auth so they cannot have the problem (
only the application native to a Microsoft Operating system).Solution... force all users to Modern Authentication. In retrospect this makes sense as I've noticed new users always got the modern auth prompt even before trying to implement MFA while the old timers like myself had basic auth prompts still pop up occasionally.
Note: this assumes you are on 2016/Outlook for Office 365, 2013 users still additionally have to enable ADAL with registry changes first, then you follow the instructions below to enable modern auth with Exchange Online-> https://support.office.com/en-us/article/enable-modern-authentication-for-office-2013-on-windows-devices-7dc1c01a-090f-4971-9677-f1b192d6c910
Solution in detail:
Run Powershell - here is another gotcha, in a fun Microsoft twist of irony if you have MFA enabled for this user you will have to download the Microsoft Exchange Online Remote Powershell Module to get modern auth in the powershell environment. If your username can log in with basic auth, search->powershell->run as admin.
Connect to Exchange Online in PowerShell
Connect-EXOPSSession -UserPrincipalName mailto:chris@contoso.com
(for US based Office 365 - for others, you will need to find the URIs)
Enable Modern Authentication in Exchange Online
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
Check Status of Modern Authentication
Get-OrganizationConfig | Format-Table Name,OAuth* -Auto
PS C:\Users\StevenOsuch> Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
PS C:\Users\StevenOsuch> Get-OrganizationConfig | Format-Table Name,OAuth* -AutoName OAuth2ClientProfileEnabled
---- --------------------------
domain.somewhere.com TrueNow open up Outlook, it worked instantly, I didn't even have to provide credentials as it pulled it from my laptop which already had the SSO profile that had been authenticated at login.
Retrospectively, looking at the Set-Up MFA for O365 article (https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide), it mentions this as well but this was just updated a couple of days ago so maybe it wasn't there before.
Final note, if you still use Skype for Business, you have to enable Modern Auth separately using the Skype specific connection and command prompts.
I just left a similar report with feedbackhub but my problems aroase from having to many users on a couple of cards with shard users on moltable systems. Any one besides me get a user diconect affter
the update.last night.
When setting up MFA you have to possibility to retrieve or create an app password. You should use that one during login in Outlook.
I never use app password, with Outlook 2016 all auth goes to ADFS.
Ap passwords i usually use on mobile devices etc.
Unfortunately, the app password does not work in this case. If you get the old Auth screen you will not be granted access in Outlook no matter what password you use.
I WAS able to successfully get this to work finally, without wiping windows OS. Here is what I did.
First: I added the registry key per the below instructions (it wasn't there originally)(also, when I "ran as admin" the "Exchange" folder wasn't present, but when I opened normally {on an AD client} the "Exchange folder WAS there.)
Second: I removed Multi-Factor Auth for my user.
Third: I opened Outlook ---> Clicked File ----> Office Account ---> I signed out of all accounts (one user had 3, one user had only 1)
Fourth: Turned back on multi factor
Fifth: Opened Outlook and when I did - In one case I had to enter the App Password in the New Style App box. In the other case, Outlook just opened and worked. In both cases multi-factor is on and continues to work. Copied and pasted the key below. Hope that helps someone.
- Exit Outlook.
- Start Registry Editor. To do this, use one of the following procedures, as appropriate for your version of Windows:
- Windows 10, Windows 8.1 and Windows 8: Press Windows Key + R to open a Rundialog box. Type regedit.exe, and then press Enter.
- Windows 7: Click Start, type regedit.exe in the search box, and then press Enter.
- In Registry Editor, locate and then click the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Exchange - On the Edit menu, point to New, and then click DWORD Value.
- Type AlwaysUseMSOAuthForAutoDiscover, and then press Enter.
- Right-click AlwaysUseMSOAuthForAutoDiscover, and then click Modify.
- In the Value data box, type 1, and then click OK.
- Exit Registry Editor.
- Me too have the same issue in my organisations. Exactly what you mention.
If you have MFA enabled, you should use an Outlook version that supports Modern authentication. 2013 SP1+ should do, but Modern auth must also be enabled client-side and server-side:
- In my organisation we are using Microsoft Office 365 Business. Is that effects the MFA?
Unbelievable. A reghack to be a fix to MFA on Office 365 accounts.
I was never able to put my finger on it, nor was MS for that matter which is sad!
I reached a point where I am down to 2 users left with this issue and our help desk has been pushing out Outlook 2016 which has Modern Auth on by default.
The issue that caused this was Outlook2013 stuck on legacy AUTH and not using Modern Auth. How can you tell? If you open Outlook Connection Status, under the AuthN field if it says clear (Legacy Auth) If it says Bearer* (Modern AUTH).
I found another fix as well but its more time consuming. I ran MS SARA and chose outlook keeps prompting for credential which also happened. Running thru that and just telling SARA to continue to fix the issue and get to a point where it asks did I want it to recreate the profile I said yes and that also did it. After letting SARA create the profile After a few minutes all the connections would start changing from Clear to BEARER. THis part took about 10 to 15 min just had to let it sit and monitor it.
If i just recreated the profile myself without sara it would not work. So that tells me that MS SARA was also wiping something out in the windows profile as 9 times out of 10 I used sara it would work.
Those times I SARA did not work and outlook still connected using legacy Auth is where I would wipe the Windows Profile.
You can also verify by going to registry HKCU\Software\microsoft\office\16.0\Common\Identity\identities
Under here you should have
https://autodiscover-s.outlook.com/
https://domain.sharepoint.com/
https://domain-my.sharepoint.com/
https://outlook.office365.com/
https://dataservice.o365filtering.com
Users who connect using Legacy Auth who also have CLear in the AUTHN column in connection status will have only 2 of these reg keys.
Alot of time wasted but at least i got to the bottom of it sort of.
We have been using office 2013 pro plus with the ADAL Reg keys in place. This setup has been in place for months. Then out of the blue after we forced a password change this issue occured.
MS says they are having issues with Outlook and ADAL ATM but there is nothing on the Portal in ref to this. I dont think OUtlook version is the issue here as this was all working fine for months until last Wednesday.
Well, the least they can do is push this info to the SHD, so make sure you give them some grief :)
