Forum Discussion

Rob Axelrod's avatar
Rob Axelrod
Copper Contributor
Jun 29, 2020
Solved

After a hybrid migration to Exchange Online Outlook clients not switching over.

Migrating users from Exchange 2010 to O365. Clients are using Outlook 2016 MSI install. After a successful migration, Outlook goes into the "disconnected" state and doesn't prompt for O365 credential...
office 365
outlook for windows
  • ChristianBergstrom's avatar
    ChristianBergstrom
    Jun 29, 2020

    Rob Axelrod Hello, not in my comfort zone here but I've heard of an almost identical issue before where they disabled MFA (temporarily) to get it to work.

     

    If that's not the case maybe this is applicable

    https://support.microsoft.com/en-us/help/3073002/after-migration-to-office-365-outlook-doesn-t-connect-or-web-services

ChristianBergstrom's avatar
ChristianBergstrom
Silver Contributor
Jun 29, 2020

Rob Axelrod Hello, not in my comfort zone here but I've heard of an almost identical issue before where they disabled MFA (temporarily) to get it to work.

 

If that's not the case maybe this is applicable

https://support.microsoft.com/en-us/help/3073002/after-migration-to-office-365-outlook-doesn-t-connect-or-web-services

Rob Axelrod's avatar
Rob Axelrod
Copper Contributor
Jun 30, 2020

ChristianBergstrom 

 

Thanks for your tips!

You first inclination was 100% correct.

 

I did a Fiddler trace on the test workstation as Outlook was trying to do Autodiscover to set itself up for the first time connecting to the cloud. I saw that it was failing to connect to O365's autodiscover service with an HTTP error of 456. Did a little research and determined that it is tied to multifactor authentication and conditional access configuration. Not sure why it works fine if you are setting up a new profile, etc but when I excluded the test account from the conditional access policy it immediately started working.
 
So now the question is what is it about the conditional access policy that conflicts with the reconfiguration of Outlook? It isn't a problem when setting up a new profile, only on the switch from on-prem to the cloud. I used this blog post to help track down the issue with that e: https://bloggymcblogface.blog/error-456-for-exchange-online-autodiscover/
  • ChristianBergstrom's avatar
    ChristianBergstrom
    Silver Contributor
    Jun 30, 2020

    Rob Axelrod Hey Rod! Glad to hear that the solution worked for you! But I can't say I know what's going on as the "456 authentication error" should indicate that MFA is enabled for your account while modern authentication is not enabled in EXO. Perhaps open a MS ticket as you said all those settings are OK.

     

    PeterRising Any idea?

    • Rob Axelrod's avatar
      Rob Axelrod
      Copper Contributor
      Jun 30, 2020
      I have a ticket open to look at the conditional access settings. Modern Auth is definately enabled since every other scenario works just fine except for the specific act of transitioning the Outlook client from on prem to the cloud post hybrid finalization. I think the answer is going to be tweaking my conditional access config so that the "Other Clients" setting isn't checked in the policy that requires multi factor.
      • Carlos67's avatar
        Carlos67
        Copper Contributor
        Mar 27, 2021

        Rob Axelrod I'm also interested in knowing Ms's response to your ticket. I am doing a migration and I have encountered the same problem. Thanks.