Outlook - Second 365 account-different tenant- fails after both MFA activated

Question

So I have admin accounts for two companies. A main account which my machine is all setup with and our new parent company account. After turning on MFA for both accounts, my Outlook stopped liking the second account - different tenant/domain. Removing the second account and attempting to re-add fails. It asks for a username and password in the old way and does not bring up the new way with the MFA etc.

Others at the parent company are running MFA and everything else works(iphone mail, etc). Was going to powershell into them to verify they indeed had that one thing you needed on and went down another rabbit hole I posted elsewhere about.

Thoughts?

Also, if the answer is to nuke the outlook profile, are there other things I need to make sure I also nuke in say, credential manager? Don't want to wait through a re-sync for no reason if I need to do other things.

vasilmichev · Answer

Version of Outlook? And of Windows? There is difference in behavior in how the W10 components (WAM) handle authentication compared to Office (ADAL), and you might be seeing just that. Try the workaround from this KB article:
https://support.microsoft.com/en-my/help/4025962/can-t-sign-in-after-update-to-office-2016-build-16-0-7967-on-windows-1

cecil c. achord · Answer

Win 10 1709, Outlook 2016/365 1804(Build 9226.2156)

So, initally I activated MFA on my main account.

My main account went completely fine, it prompted my shortly after doing turning on MFA with a login screen so logged in, then approved via MS Auth app for iphone.

Next, I activated MFA on the second account on the other domain/tenant.

This also went fine, and did the same as the previous account.

That was yesterday.

Today, launch outlook and am presented with an older style username/password box for the second account. I put that in and it errors. First account is still fine.

I remove the second account, thinking I would just have to re-add it. (I had to do this for both on my iphone for some reason)

I go to re-add, File>Account Settings>New

Put the second account e-mail in, it then comes up with the older style box again, then fails with a "Something went wrong" "Something went wrong and Outlook couldn't set up your account" with no specific code

Would that KB article still apply? It's none of the 6 symptoms.

vasilmichev · Answer

Is Modern authentication (and MAPI/HTTP) enabled in that second account's tenant?

cecil c. achord · Answer

I have asked them and haven't heard back about that.&nbsp; Since I was unable to powershell into them(my other post in a different section of this community site), I couldn't check myself.&nbsp;I have shut off 2-factor for my account with them in the meantime.&nbsp;They currently use Dirsync with their on-prem AD and have told me that they all had to use an app password for their Outlook with 2-factor on.&nbsp; I guess that answers that so I will try 2-factor again and use an app password instead.&nbsp;I suppose they will be able to use modern auth once they get AD Connect and MFA Server going with passthough authentication.&nbsp; But Dirsync was just a more simple sync so I still don't know why modern auth wouldn't work for them, or why it works for roughly the first day, then fails completely - and iphone mail still works modern auth for that tenant.&nbsp; Who knows.

niko1995 · Answer

Cecil C. Achord&nbsp;Did you ever find a resolution to this?&nbsp; I too am having a very similar problem once adding enabling MFA on another email address within Outlook from a different Tenant.&nbsp; Once I set it up it initially looked to be working but I noticed a few hours later all of the users that shows their MFA as "Enforced" they could not access their email.&nbsp; I would prompt them for their password but they'd never get logged in.&nbsp; They did report that it was working fine on their cell phones though.&nbsp;

Forum Discussion

Outlook - Second 365 account-different tenant- fails after both MFA activated

Share

Resources