Outlook login issues with WVD - FSLogix

[DAsnow]

Having an issue where user of WVD Windows 10 Multi-session have issues moving between hosts. Essentially first login on a host is fine, when the user moves to a new host outlook eventually says "need password" however the modern authentication prompts are never presented to the user.

Anyone have any insight? Perhaps Something with AzureFiles / FSlogix?

Thanks in advance.

[#2]

This in conjunction with the GPO to block future Azure AD Joins is the solution

[#3]

@DAsnow 

Sorry to post in an older thread but I am seeing issues with additional mailboxes in Outlook with AVD.

Adding the mailbox will work initially but the next day when the user logs in the additional mailbox does not update and the 'Needs password' appears but prompt box will not show - removing the mailbox and trying to re-add then gives error that mailbox cannot be added and to retry. Recreating the whole FSLogix profile fixes but only creating new Outlook profile does not - anyone have any idea what is causing this and a fix?

[#4]

A long time WVD/AVD administrator here and we're now picking up on some oddities:

First of all mentioning what has and does work perfectly:
AVD VM's are not WorkPlaceJoined like the initial problem in this thread
SSO works for the user logging on
MFA works as expected
FSLogix roaming handles logging on to multiple machines

The problems start when due to business needs a 2nd O365 account gets added to outlook or teams. Especially if that second O365 account is not within the same tenant of the user logging on (the user logging on handles the Windows/Office licensing as required). Another way to make sure it breaks is by adding only a foreign O365 account to Outlook and then logging on to another VM. 

The only "fix" we've found so far is to disable WAM and re-enable ADAL. That fixes the issues but isn't recommended or desired in the long run.

Is anyone able to confirm they have a setup like this working with email/Teams accounts other than the logged in user? Or does adding other accounts to Outlook with MFA simply break SSO on AVD/FSlogix setups? The problem persists over multiple different AVD setups

[#5]

@KevinDeSchrijver 

We have the same Setup on Terminalserver 2019 with FSLogix and from time to time, the login breaks. 

We did not test to disable ADAL or something. 

We log the User off, let him login on another Terminalserver (It's a Broker Setup with 2 Terminalservers in it) and then the outlook runs fine on the other server. 

On the next day it doesn't matter which terminalserver the user is working on.

We did not found any other solution yet. 

[#6]

@KevinDeSchrijver 

Same issue only with RDS. Latest FSLogix installed but when they change password they loose connection with Office365 and password needed is showing. Prompt wont pop-up and seems to happen with the users that got multiple accounts added from different tenants.

We use DUO as MFA. They will force modern authentication soon so disable this wont help.

Solution what seems to work is logging them off in outlook and sign back in and approve with MFA again.

[#7]

@KBanko 

We have the exact same Problem since last week. FSlogix on Terminalserver 2019 with one broker and two Sessionhosts. Did you find any ohter solution than loggin the user on the other server and keep waiting?

[#8]

@Uli990 

Nope, still no fix. 

Really annoying.

[#9]

Following fix in place at the moment:

Create GPO to add the following Registry key or manually create:
HKEY_LOCAL_MACHINE\Software\FSlogix\Profiles
KeepLocalDir DWORD 1

Then add a "redirections.xml" file in the following location of each user:
c:\users\%username%\AppData\Local\FSLogix

The redirection only works when the file is present upon logon so do a logoff/logon afterwards or inject into the dormant profile.

Contents of redirections.xml file:
<?xml version="1.0" encoding="UTF-8"?><FrxProfileFolderRedirection>
<Excludes>
<Exclude Copy="0">AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy</Exclude>
<Exclude Copy="0">AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\TokenBroker</Exclude>
</Excludes>
</FrxProfileFolderRedirection>

You will have to enter credentials on EACH Session Host ONCE but after that you can move between hosts without any issue.

The theory of this fix:
Modern Authentication works with Tokens. Those tokens contain the Device ID. Storing them in FSLogix breaks them because the Device ID contained in them no longer matches. The fix pushes those tokens out of the FSLogix container to a local_username folder and no longer deletes that folder upon logoff from the machine. Once you have a working token on each host it will refresh if needed but it no longer breaks. Hope this helps because MS was clueless after spending a few weeks with the FSLogix/Office teams.

[#10]

Will give it a try.
The theory sounds logical to me.
Hope Microsoft will find an official fix soon...

Thanks for your work!

[#11]

Sounds logical but still leave me with questions.
- Only one customer got issues while we have multiple setups like this
- Only happens after password change (in our case)
- I dont see this issue on VDI while they change desktops every day

Only difference is that some users got multiple accounts in outlook from different tenants, but also see this happen with users that got a single account after changing password.

[#12]

There are more than 1 reason why Modern Authentication can break. My situation and the fix is very specific:
The use-case is multiple Hosts AND multiple O365 accounts (or an O365 account that isn't covered by SSO)

In VDI and almost any setup you should have SSO configured which handles the primary O365 account. If it "breaks" by moving to another VM, SSO kicks in and repairs it without the user ever noticing.

My fix is only intended if both conditions are met: Multiple hosts and multiple O365 accounts.

If you are having issues with Modern Auth and those conditions are not met I suggest looking at SSO which may not be configured or may not function as desired. Seems like the case with the changing password issue. Your local AD may not be in sync with AAD.

[#13]

Hi Kevin,

SSO works even when Outlook is broken, customer got Mutiple hosts and some users mutiple O365 accounts from different tenants. But we also see outlook broken issues with the users that
dont have the second tenant account added.

Outlook breaks after user change password (They needed to change password every 42 days).
Looks like they need to set new password / token on both RD-Host servers.

We see logs in Azure AD like

"The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '{authTime}' and the TokensValidFrom date (before which tokens are not valid) for this user is '{validDate}'."

Expected part of the token lifecycle - either an admin or a user revoked the tokens for this user, causing subsequent token refreshes to fail and require re-authentication. Have the user sign-in again.

Error code: 50173

Next test case will be to extend the password change to 365 and see if it still happen. Token refresh is 90 days i understand.

[#14]

@KevinDeSchrijver Wont you have an issue when you re-image the host-pool? Everyone will have to sign in to the new hosts again or am I missing something here.

[#15]

This is indeed the case. No solution for that I'm afraid.

The solution I posted only applies to the specific case and I only created it myself after hitting a dead wall with MS support who started opening their umbrella with statements like: Indeed, having more then one O365 account (Hello, mailaccounts?) is not supported with FSLogix on multiple hosts.

I based my solution on this:
https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-device-identity-virtual-deskt...

[#16]

This appears to be a new problem as I have been running AVD multi-session environments for a year now with all the "fixes" and settings set from the start. No issue for 12 months but after the December Windows patches were installed they seem to break the sign in tokens both on my existing environments and my new environments.

[#17]

So it seems to have nothing to do with the windows update. 

I fixed my issue by rolling back FSLogix to 2210 to 2201. There is a known issue for those devices that can't be Azure AD joined or Hybrid joined. So if you are using AADDS then don't update past version 2201 of FSLogix.
https://learn.microsoft.com/en-us/fslogix/troubleshooting-known-issues#azure-ad-authentication-for-a...

[#18]

Thank you for the heads up on the new fslogix issue. I cant tell if this known issue is a bug or just how Microsoft intends to treat AADDS joined machines in the future.

[#19]

The problem is wider then that. My machines ARE Hybrid joined. Even if they're Hybrid joined, you will be prompted every single logon for O365 credentials for SECONDARY (mail) O365 accounts. Granted, that's not a very common use-case but still.

My fix doesn't work for 2210 either. It looks like you can redirect those folders out of FSLogix as much as you want to, FSLogix will still "ignore" them. Obviously they changed something in the behaviour there. Still awaiting MS response on the open Case.

[#20]

Does the change of basic authentication to modern authentication anything to do with it? Microsoft is forcing modern authentication for tenants now.

[#21]

Ofcourse. With Basic Auth you don't/didn't have any of these issues. It's the way Modern Auth works (token based with Device ID) that's breaking things.

Modern Auth is a good thing, it just creates issues for AVD/VDI that haven't been properly vetted out yet.