Outlook for iOS Account blocked after password change

%3CLINGO-SUB%20id%3D%22lingo-sub-1406500%22%20slang%3D%22en-US%22%3EOutlook%20for%20iOS%20Account%20blocked%20after%20password%20change%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1406500%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%40all!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20someone%20can%20help%20me%20solve%20this%20wired%20issue.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20about%2080%20Intune%20Enrolled%20Devices.%20Just%20iOS.%3C%2FP%3E%3CP%3EMy%20Users%20now%20gets%20pushed%20the%20Outlook%20App%20by%20Intune%20since%20we%20changed%20to%20this%20app.%3C%2FP%3E%3CP%3EBefore%20they%20downloaded%20it%20from%20AppStore%20or%20Company%20Portal.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOutlook%20connects%20to%20Exchange%20Online.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%20Outlook%20App%20Configuration%20Policy%20where%20we%20set%20under%20E-Mail%20Account%20configuration%3A%3C%2FP%3E%3CDIV%20class%3D%22fxc-summary-item-row%22%3E%3CDIV%20class%3D%22fxc-summary-item%20azc-text-label%22%3E%3CDIV%3EConfigure%20email%20account%20settings%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item%20fxc-summary-item-value%22%3E%3CDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EYes%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item-row%22%3E%3CDIV%20class%3D%22fxc-summary-item%20azc-text-label%22%3E%3CDIV%3EAuthentication%20type%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item%20fxc-summary-item-value%22%3E%3CDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EModernAuth%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item-row%22%3E%3CDIV%20class%3D%22fxc-summary-item%20azc-text-label%22%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EUsername%20attribute%20from%20AAD%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item%20fxc-summary-item-value%22%3E%3CDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EUser%20Principal%20Name%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item-row%22%3E%3CDIV%20class%3D%22fxc-summary-item%20azc-text-label%22%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EEmail%20address%20attribute%20from%20AAD%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item%20fxc-summary-item-value%22%3E%3CDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EPrimary%20SMTP%20Address%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item-row%22%3E%3CDIV%20class%3D%22fxc-summary-item%20azc-text-label%22%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EAllow%20only%20work%20or%20school%20accounts%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-summary-item%20fxc-summary-item-value%22%3E%3CDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EDisabled%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EHere%20is%20my%20problem%3A%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EUsers%20have%20to%20change%20their%20Domain%20Password%20every%206%20Month.%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EAfter%20this%20password%20change%20some%20Users%20get%20an%20Error%20message%20when%20they%20start%20Outlook%20what%20says%3A%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EAccount%20Blocked%20-%20Your%20Account%20is%20Blocked.%20Please%20contact%20your%20System%20Administrator%20to%20unblock%20your%20account.%20(Attachment)%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EBut%20the%20Account%20isn%C2%B4t%20locked.%20Or%20I%20don%C2%B4t%20know%20where%20to%20look%3F%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EAt%20some%20users%20it%20worked%20again%20after%20two%20days.%20But%20I%20don%C2%B4t%20know%20why%20this%20happened%20and%20how%20to%20solve%20it%3F%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3ENow%20I%20have%20a%20User%20were%20it%20isn%C2%B4t.%20I%20already%20retired%20and%20re-enrolled%20his%20device%20but%20with%20no%20luck.%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3ECan%20someone%20please%20help%20me%20to%20figure%20this%20out%20why%20this%20happened%3F%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EI%20also%20checked%20on%20Exchange%20Online%20AdminCenter.%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3Ein%20%22mobile%20device%20access%22%20we%20do%20not%20have%20any%20policies%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3Ein%20%22mobile%20device%20mailbox%20policies%22%20we%20just%20have%20the%20default%20policy.%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EWhen%20I%20look%20in%20recipients%20mailbox%20under%20mailbox%20features%20Mobile%20Devices%20I%20see%20%22Access%20granted%22%3F%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EI%20hope%20it%20is%20clear%20what%20my%20problem%20is.%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EAnd%20sorry%3CSPAN%3E%26nbsp%3Bfor%20the%20long%20text...%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3EThanks!%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22OutlookiOS_Account_Blocked.jpg%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F193359i6B55266001F4CBA6%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22OutlookiOS_Account_Blocked.jpg%22%20alt%3D%22OutlookiOS_Account_Blocked.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%3CP%3E%E2%80%83%E2%80%83%3C%2FP%3E%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22OutlookiOS_config.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F193360iCB63F9EAD65261D6%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22OutlookiOS_config.png%22%20alt%3D%22OutlookiOS_config.png%22%20%2F%3E%3C%2FSPAN%3E%3CP%3E%E2%80%83%3C%2FP%3E%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22ext-summary-stringItem%22%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1406500%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMobile%20Application%20Management%20(MAM)%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMobile%20Device%20Management%20(MDM)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1407274%22%20slang%3D%22en-US%22%3ERe%3A%20Outlook%20for%20iOS%20Account%20blocked%20after%20password%20change%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1407274%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F462131%22%20target%3D%22_blank%22%3E%40maple85%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFirst%20thing%20came%20to%20my%20mind%2C%20do%20you%20have%20Conditional%20Access%20Policy%20that%20conflicts%20with%20your%20setup%3F%20Do%20you%20see%20any%20'%3CSPAN%3EDevice%20Access%20Rules'%20under%20Mobile%20section%20in%20Exchange%20Online%3F%3C%2FSPAN%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ELast%20resort%2C%20it%20could%20be%20App%20config%20policy%2C%20do%20you%20have%20legacy%26nbsp%3Bauthentication%26nbsp%3Bdisabled%20in%20your%20tenant%3F%20I%20would%20check%20the%20sign%20in%20log%20from%20Azure%20AD-%26gt%3B%20Add%20Filter-%26gt%3B%20Client%20App-%26gt%3B%20Check%20all%20the%20boxed%20to%20see%20if%20somehow%20these%20Outlook%20apps%20are%20trying%20to%20use%20something%20other%20than%20Modern%20Auth.%20This%20log%20should%20shed%20some%20light%20about%20the%20issue.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EGood%20Luck!%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EMoe%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThanks!%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EMoe%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1407862%22%20slang%3D%22en-US%22%3ERe%3A%20Outlook%20for%20iOS%20Account%20blocked%20after%20password%20change%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1407862%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3EI%20have%20checked%20your%20Suggestion.%3CBR%20%2F%3EOn%20Exchange%20Online%20we%20do%20not%20have%20any%20device%20Access%20rules.%3CBR%20%2F%3E%3CBR%20%2F%3EWhen%20I%20check%20the%20sign-in%20Logs%20I%20See%20some%20tries%20from%20%E2%80%9EChina%2C%20Chisinau%20Bangkok%2C...)%20Where%20someone%20tried%20to%20log%20in%20to%20his%20Account%20with%20imap4%20as%20Client%20App.%3CBR%20%2F%3EFailure%20Reason%3A%20Account%20is%20locked%20because%20user%20tried%20to%20sign%20in%20too%20many%20times%20with%20an%20incorrect%20user%20ID%20or%20password.%3CBR%20%2F%3ELast%20try%20was%202nd%20May.%3CBR%20%2F%3E%3CBR%20%2F%3EAnd%20yes%20we%20have%20two%20conditional%20Access%20policies%20who%20Block%20Legacy%20Auth%20and%20EAS.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3EStrange%20thing%20is%20That%20i%20did%20not%20See%20the%20sign%20in%20try%20in%20the%20azure%20logs.%3CBR%20%2F%3EUser%20told%20me%3A%3CBR%20%2F%3E1)%20Open%20Outlook%3CBR%20%2F%3E2)%20Enter%20his%20password%3CBR%20%2F%3E3)%20Outlook%20wants%20Open%20Authenticator%20App%3CBR%20%2F%3E4)%20User%20Click%20on%20his%20Account%20in%20MS%20Authenticator%20App%3CBR%20%2F%3E5)%20Error%20Message%3CBR%20%2F%3E%3CBR%20%2F%3EThanks!%3CBR%20%2F%3EPhilip%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1412884%22%20slang%3D%22en-US%22%3ERe%3A%20Outlook%20for%20iOS%20Account%20blocked%20after%20password%20change%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1412884%22%20slang%3D%22en-US%22%3EHi%20Philip%2C%3CBR%20%2F%3E%3CBR%20%2F%3EI%20think%20the%20issue%20with%20CA%20policy%2C%20could%20you%20please%20create%20new%2Fexisting%20user%20and%20exclude%20from%20the%20CA%20policy%3F%20Let%20it%20expire%20(create%20dump%20expiration%20policy)%20and%20see%20how%20it%20goes.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20think%20you%20may%20need%20to%20block%20legacy%20authentication%20using%20Security%20Defaults%20from%20Azure%20AD%2C%20because%20the%20default%20ones%20in%20CA%20will%20be%20deprecated%20soon.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Fconcept-fundamentals-security-defaults%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Fconcept-fundamentals-security-defaults%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EMoe%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1413665%22%20slang%3D%22en-US%22%3ERe%3A%20Outlook%20for%20iOS%20Account%20blocked%20after%20password%20change%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1413665%22%20slang%3D%22en-US%22%3EI%20think%20it%20might%20be%20a%20coincidence%20that%20your%20users%20are%20getting%20this%20prompt%20as%20you%20have%20spotted%20malicious%20sign-ins.%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20a%20lot%20of%20failed%20sign-ins%20happen%20in%20a%20short%20timespan%2C%20the%20account%20can%20get%20locked%20as%20specified%20in%20%3CA%20href%3D%22https%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_IAM%2FPasswordProtectionBlade%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_IAM%2FPasswordProtectionBlade%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EI%20would%20recommend%20also%20disabling%20legacy%20authentication%20using%20Authentication%20Policies%20in%20Exchange%20Online.%20Because%20this%20would%20make%20sure%20an%20account%20isn't%20locked%20due%20to%20failed%20sign-ins%20while%20using%20legacy%20authentication%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1417305%22%20slang%3D%22en-US%22%3ERe%3A%20Outlook%20for%20iOS%20Account%20blocked%20after%20password%20change%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1417305%22%20slang%3D%22en-US%22%3EThank%20you%20for%20that%20tip.%3CBR%20%2F%3EBut%20last%20malicious%20sign-ins%20were%20on%202th%20May%20but%20it%20is%20still%20not%20working.%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20I%20create%20this%20policy%20on%20Exchange%2C%20what%20I%20think%20is%20a%20good%20idea%2C%20I%20think%20I%20will%20get%20troubles%20with%20some%20old%20services%20what%20use%20smtp...%3F%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%2C%20Philip%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1420401%22%20slang%3D%22en-US%22%3ERe%3A%20Outlook%20for%20iOS%20Account%20blocked%20after%20password%20change%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1420401%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3EI%20found%20a%20solution.%3C%2FP%3E%3CP%3EThe%20Problem%20was%20that%20the%20iPhone%20saves%20Accountinformation%20in%20Key-Chain.%3C%2FP%3E%3CP%3EI%20downloaded%20the%20OneDrive%20App.%3C%2FP%3E%3CP%3EOpen%20Settings%20-%26gt%3B%20OneDrive%20-%26gt%3B%20Clear%20Account%20Data%3C%2FP%3E%3CP%3EThen%20opened%20the%20OneDrive%20App%20to%20delete%20data.%3C%2FP%3E%3CP%3Ein%20Azure%20AD%20I%20clicked%20on%20Revoke%20MFA%20session%20and%20reinstalled%20Outlook.%3C%2FP%3E%3CP%3EAfter%20this%20steps%20it%20worked.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20article%20pointed%20me%20to%20the%20right%20direction%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fmicrosoftteams.uservoice.com%2Fforums%2F555103-public%2Fsuggestions%2F37422262-ios-apps-cannot-clear-account-information-that-has%3Fpage%3D1%26amp%3Bper_page%3D20%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fmicrosoftteams.uservoice.com%2Fforums%2F555103-public%2Fsuggestions%2F37422262-ios-apps-cannot-clear-account-information-that-has%3Fpage%3D1%26amp%3Bper_page%3D20%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hello @all!

 

Hope someone can help me solve this wired issue.

 

We have about 80 Intune Enrolled Devices. Just iOS.

My Users now gets pushed the Outlook App by Intune since we changed to this app.

Before they downloaded it from AppStore or Company Portal.

 

Outlook connects to Exchange Online.

 

We have a Outlook App Configuration Policy where we set under E-Mail Account configuration:

Configure email account settings
Yes
 
Authentication type
ModernAuth
 
Username attribute from AAD
User Principal Name
 
Email address attribute from AAD
Primary SMTP Address
 
Allow only work or school accounts
Disabled
 
Here is my problem:
Users have to change their Domain Password every 6 Month.
After this password change some Users get an Error message when they start Outlook what says: 
Account Blocked - Your Account is Blocked. Please contact your System Administrator to unblock your account. (Attachment)
 
But the Account isn´t locked. Or I don´t know where to look?
At some users it worked again after two days. But I don´t know why this happened and how to solve it?
 
Now I have a User were it isn´t. I already retired and re-enrolled his device but with no luck.
 
Can someone please help me to figure this out why this happened? 
 
I also checked on Exchange Online AdminCenter.
in "mobile device access" we do not have any policies
in "mobile device mailbox policies" we just have the default policy.
 
When I look in recipients mailbox under mailbox features Mobile Devices I see "Access granted"?
 
I hope it is clear what my problem is.
And sorry for the long text...
 
Thanks!
 
OutlookiOS_Account_Blocked.jpg

  

OutlookiOS_config.png

 
 
6 Replies
Highlighted

@maple85 

 

First thing came to my mind, do you have Conditional Access Policy that conflicts with your setup? Do you see any 'Device Access Rules' under Mobile section in Exchange Online? 

 

Last resort, it could be App config policy, do you have legacy authentication disabled in your tenant? I would check the sign in log from Azure AD-> Add Filter-> Client App-> Check all the boxed to see if somehow these Outlook apps are trying to use something other than Modern Auth. This log should shed some light about the issue.

 

Good Luck!

Moe

 

Thanks!

Moe

Highlighted
Hi,
I have checked your Suggestion.
On Exchange Online we do not have any device Access rules.

When I check the sign-in Logs I See some tries from „China, Chisinau Bangkok,...) Where someone tried to log in to his Account with imap4 as Client App.
Failure Reason: Account is locked because user tried to sign in too many times with an incorrect user ID or password.
Last try was 2nd May.

And yes we have two conditional Access policies who Block Legacy Auth and EAS.


Strange thing is That i did not See the sign in try in the azure logs.
User told me:
1) Open Outlook
2) Enter his password
3) Outlook wants Open Authenticator App
4) User Click on his Account in MS Authenticator App
5) Error Message

Thanks!
Philip
Highlighted
Hi Philip,

I think the issue with CA policy, could you please create new/existing user and exclude from the CA policy? Let it expire (create dump expiration policy) and see how it goes.

I think you may need to block legacy authentication using Security Defaults from Azure AD, because the default ones in CA will be deprecated soon.

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-d...

Moe
Highlighted
I think it might be a coincidence that your users are getting this prompt as you have spotted malicious sign-ins.

If a lot of failed sign-ins happen in a short timespan, the account can get locked as specified in https://portal.azure.com/#blade/Microsoft_AAD_IAM/PasswordProtectionBlade

I would recommend also disabling legacy authentication using Authentication Policies in Exchange Online. Because this would make sure an account isn't locked due to failed sign-ins while using legacy authentication

Highlighted
Thank you for that tip.
But last malicious sign-ins were on 2th May but it is still not working.

If I create this policy on Exchange, what I think is a good idea, I think I will get troubles with some old services what use smtp...?

Thanks, Philip
Highlighted

Hi All,

I found a solution.

The Problem was that the iPhone saves Accountinformation in Key-Chain.

I downloaded the OneDrive App.

Open Settings -> OneDrive -> Clear Account Data

Then opened the OneDrive App to delete data.

in Azure AD I clicked on Revoke MFA session and reinstalled Outlook.

After this steps it worked.

 

This article pointed me to the right direction:

https://microsoftteams.uservoice.com/forums/555103-public/suggestions/37422262-ios-apps-cannot-clear...