Home

Modern Auth Looping with Outlook 2016 when Outside Corporate Network

%3CLINGO-SUB%20id%3D%22lingo-sub-280804%22%20slang%3D%22en-US%22%3EModern%20Auth%20Looping%20with%20Outlook%202016%20when%20Outside%20Corporate%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-280804%22%20slang%3D%22en-US%22%3E%3CP%3EHello!%20First%20time%20poster%2C%20here.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20the%20past%20~1-2%20months%2C%20our%20travelling%20users%20have%20been%20running%20into%20an%20authentication%20loop%20in%20Outlook%202016.%20They%20will%20suddenly%20be%20asked%20to%20enter%20their%20password%20in%20Outlook%20(the%20larger%2C%20white%2C%20browser-based%20modern%20authentication%20window%2C%20not%20the%20small%20Outlook%20client%20username%2Fpassword%20authentication%20window).%20Entering%20their%20password%20will%20close%20the%20window%2C%20then%20the%20window%20will%20immediately%20pop%20back%20up.%20The%20Outlook%20client%20cannot%20be%20used%20until%20they%20come%20back%20inside%20our%20network%20and%20reboot%20their%20PC.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20was%20able%20to%20immediately%20reproduce%20the%20issue%20on%20my%20work%20laptop%20(64-bit%20Windows%2010%201803%20running%20Office%202016%2032-bit%20version%201809)%20by%20deleting%20my%20Outlook%20profile%2C%20deleting%20all%20saved%20Office-related%20credentials%20in%20the%20Credential%20Manager%2C%20and%20connecting%20my%20laptop%20to%20my%20smartphone%20hotspot%20(to%20simulate%20being%20outside%20the%20network).%20Starting%20Outlook%202016%2C%20I'll%20create%20a%20new%20profile%2C%20connect%20with%20my%20AD%20account%2C%20enter%20my%20password%20in%20the%20Outlook%202016%20authentication%20box%3B%20my%20email%20will%20actually%20start%20loading%20in%20Outlook%2C%20then%20the%20larger%2C%20white%20authentication%20window%20will%20pop%20up.%20I%20enter%20my%20password%2C%20it%20will%20disappear%2C%20then%20pop%20up%20again%2C%20and%20on%2C%20and%20on...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20worked%20with%20MS%20Support%20on%20this%20issue%20for%20a%20total%20of%20~7%20hours%20in%20multiple%20remote%20sessions%2C%20and%20here%20are%20the%20troubleshooting%20steps%20they%20took%2C%20which%20all%20failed%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E-Using%20an%20app%20password%20when%20the%20MFA%20browser%20window%20asks%20for%20the%20user%E2%80%99s%20password%20(%E2%80%9Cinvalid%20password%E2%80%9D)%3C%2FP%3E%3CP%3E-Adding%20%E2%80%9CHKEY_CURRENT_USER%5CSoftware%5CMicrosoft%5COffice%5C16.0%5CCommon%5CIdentity%5CDisableADALatopWAMOverride%E2%80%9D%20to%20the%20registry%2C%20with%20a%20DWORD%20value%20of%201%3C%2FP%3E%3CP%3E-Using%20%E2%80%9CFiddler%E2%80%9D%20to%20collect%20logs%20while%20the%20issue%20occurred%20(the%20technician%20seemed%20like%20they%20had%20no%20idea%20how%20to%20use%20the%20program%2C%20since%20the%20certificates%20installed%20by%20the%20program%20effectively%20blocked%20Outlook%202016%20from%20communicating%20with%20the%20Microsoft%20servers)%3C%2FP%3E%3CP%3E-Turning%20on%20Outlook%20logging%2C%20and%20reproducing%20the%20issue.%20The%20logs%20were%20not%20affected%20in%20any%20way%20while%20the%20looping%20was%20taking%20place%2C%20leading%20us%20to%20believe%20that%20the%20issue%20is%20taking%20place%20outside%20of%20the%20Outlook%20application.%3C%2FP%3E%3CP%3E-MS%20O365%20Support%20then%20brushed%20it%20off%20as%20Incident%26nbsp%3B%3CSPAN%3EEX152471%2C%20which%20was%20announced%20as%20resolved%20yesterday%20evening%2C%20but%20the%20problem%20still%20persists%20in%20our%20environment.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThe%20ONLY%20workaround%20that%20we%20found%2C%20is%20adding%20%22DisableAADWAM%22%20to%26nbsp%3BHKEY_CURRENT_USER%5CSoftware%5CMicrosoft%5COffice%5C16.0%5CCommon%5CIdentity%5C%2C%20and%20giving%20it%20a%20DWORD%20value%20of%201.%20But%20disabling%20Web%20Access%20Management%20is%20not%20a%20solution!%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ECan%20anyone%20shed%20any%20light%20on%20our%20issue%3F%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThank%20you%2C%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E--Ryan%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-280804%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAuthentication%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20Apps%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-324499%22%20slang%3D%22en-US%22%3ERe%3A%20Modern%20Auth%20Looping%20with%20Outlook%202016%20when%20Outside%20Corporate%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-324499%22%20slang%3D%22en-US%22%3EThe%20latest%20Office%20update%20ended%20up%20fixing%20the%20issue%20for%20us.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-323873%22%20slang%3D%22en-US%22%3ERe%3A%20Modern%20Auth%20Looping%20with%20Outlook%202016%20when%20Outside%20Corporate%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-323873%22%20slang%3D%22en-US%22%3E%3CP%3EAlso%20an%20ongoing%20thread%20about%20this%20here%20(note%20that%20the%20top%20post%20in%20the%20Uservoice%20thread%20mentions%20the%20OLD%20reg%20key%2C%20but%20recent%20comments%20make%20clear%20what's%20currently%20working)%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Foffice365.uservoice.com%2Fforums%2F264636-general%2Fsuggestions%2F32694751-outlook-is-not-syncing-and-giving-a-need-password%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Foffice365.uservoice.com%2Fforums%2F264636-general%2Fsuggestions%2F32694751-outlook-is-not-syncing-and-giving-a-need-password%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhy%20is%20this%20still%20an%20issue%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291617%22%20slang%3D%22en-US%22%3ERe%3A%20Modern%20Auth%20Looping%20with%20Outlook%202016%20when%20Outside%20Corporate%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291617%22%20slang%3D%22en-US%22%3EI%20have%20the%20same%20issue%20in%20some%20BYOD%20machines.%3CBR%20%2F%3EAfter%20too%20many%20tries%2C%20the%20solution%20was%20reinstall%20the%20operating%20system.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-281157%22%20slang%3D%22en-US%22%3ERe%3A%20Modern%20Auth%20Looping%20with%20Outlook%202016%20when%20Outside%20Corporate%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-281157%22%20slang%3D%22en-US%22%3E%3CP%3EVasil%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20your%20response!%20Unfortunately%2C%20resolution%20of%20EX152471%20didn't%20resolve%20our%20problem.%20On%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4025962%2Fcant-sign-in-after-update-to-office-2016-build-16-0-7967-on-windows-10%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ethis%20incident's%20resolution%20page%26nbsp%3B%3C%2FA%3E%2C%20Symptom%202%20is%20the%20only%20symptom%20similar%20to%20our%20problem%2C%20but%26nbsp%3B%3CSPAN%3EAADSTS70002%20is%20not%20showing%20up%20in%20the%20AAD%20Operational%20Logs%20of%20an%20affected%20PC.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-280987%22%20slang%3D%22en-US%22%3ERe%3A%20Modern%20Auth%20Looping%20with%20Outlook%202016%20when%20Outside%20Corporate%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-280987%22%20slang%3D%22en-US%22%3E%3CP%3EThere's%20an%20ongoing%20service%20incident%20causing%20(EX152471)%26nbsp%3Bthis%2C%20it%20should%20be%20resolved%20soon.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-811179%22%20slang%3D%22en-US%22%3ERe%3A%20Modern%20Auth%20Looping%20with%20Outlook%202016%20when%20Outside%20Corporate%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-811179%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20taken%20to%20setting%20the%20DisableAADWAM%20key%20by%20group%20policy%20at%20clients.%20So%20far%2C%20I%20have%20never%20once%26nbsp%3Bin%20any%20way%20used%20it%2C%20and%20don't%20see%20any%20benefit%20to%20it%20whatsoever.%20Bugs%2C%20however%2C%20have%20been%20aplenty.%3C%2FP%3E%3CP%3EWhy%20is%20it%20on%20by%20default%3F%3C%2FP%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1062640%22%20slang%3D%22en-US%22%3ERe%3A%20Modern%20Auth%20Looping%20with%20Outlook%202016%20when%20Outside%20Corporate%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1062640%22%20slang%3D%22en-US%22%3EA%20colleague%20of%20mine%20of%20able%20to%20resolve%20this%20issue%20using%20the%20following%20registry%20key%3A%3CBR%20%2F%3EHKEY_CURRENT_USER%5CSoftware%5CMicrosoft%5COffice%5C16.0%5CCommon%5CIdentity%3CBR%20%2F%3EEnableADAL%20and%20set%20to%200%3CBR%20%2F%3E%3CBR%20%2F%3EHope%20this%20helps!%20Cheers!%3C%2FLINGO-BODY%3E
Highlighted
Ryan Clegg
Occasional Contributor

Hello! First time poster, here.

 

In the past ~1-2 months, our travelling users have been running into an authentication loop in Outlook 2016. They will suddenly be asked to enter their password in Outlook (the larger, white, browser-based modern authentication window, not the small Outlook client username/password authentication window). Entering their password will close the window, then the window will immediately pop back up. The Outlook client cannot be used until they come back inside our network and reboot their PC.

 

I was able to immediately reproduce the issue on my work laptop (64-bit Windows 10 1803 running Office 2016 32-bit version 1809) by deleting my Outlook profile, deleting all saved Office-related credentials in the Credential Manager, and connecting my laptop to my smartphone hotspot (to simulate being outside the network). Starting Outlook 2016, I'll create a new profile, connect with my AD account, enter my password in the Outlook 2016 authentication box; my email will actually start loading in Outlook, then the larger, white authentication window will pop up. I enter my password, it will disappear, then pop up again, and on, and on...

 

We have worked with MS Support on this issue for a total of ~7 hours in multiple remote sessions, and here are the troubleshooting steps they took, which all failed:

 

-Using an app password when the MFA browser window asks for the user’s password (“invalid password”)

-Adding “HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity\DisableADALatopWAMOverride” to the registry, with a DWORD value of 1

-Using “Fiddler” to collect logs while the issue occurred (the technician seemed like they had no idea how to use the program, since the certificates installed by the program effectively blocked Outlook 2016 from communicating with the Microsoft servers)

-Turning on Outlook logging, and reproducing the issue. The logs were not affected in any way while the looping was taking place, leading us to believe that the issue is taking place outside of the Outlook application.

-MS O365 Support then brushed it off as Incident EX152471, which was announced as resolved yesterday evening, but the problem still persists in our environment.

 

The ONLY workaround that we found, is adding "DisableAADWAM" to HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity\, and giving it a DWORD value of 1. But disabling Web Access Management is not a solution!

 

Can anyone shed any light on our issue? 

 

Thank you,

 

--Ryan

7 Replies
Highlighted

There's an ongoing service incident causing (EX152471) this, it should be resolved soon.

Vasil,

 

Thanks for your response! Unfortunately, resolution of EX152471 didn't resolve our problem. On this incident's resolution page , Symptom 2 is the only symptom similar to our problem, but AADSTS70002 is not showing up in the AAD Operational Logs of an affected PC. 

Highlighted
I have the same issue in some BYOD machines.
After too many tries, the solution was reinstall the operating system.
Highlighted

Also an ongoing thread about this here (note that the top post in the Uservoice thread mentions the OLD reg key, but recent comments make clear what's currently working):

https://office365.uservoice.com/forums/264636-general/suggestions/32694751-outlook-is-not-syncing-an...

 

Why is this still an issue?

Highlighted
The latest Office update ended up fixing the issue for us.
Highlighted

I've taken to setting the DisableAADWAM key by group policy at clients. So far, I have never once in any way used it, and don't see any benefit to it whatsoever. Bugs, however, have been aplenty.

Why is it on by default?

 
 
 
Highlighted
A colleague of mine of able to resolve this issue using the following registry key:
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
EnableADAL and set to 0

Hope this helps! Cheers!
Related Conversations