Why Teams desktop client does not auto-login using ADFS?

[kpsingh]

On a domain bound machine, while opening MS Teams it does not auto-login user and shows following prompt:

• Tried to SSO to MS Excel and it worked on same machine and did not prompt for credentials
• Windows 10 has been updated to latest version 2004

[#2]

@kpsingh Hello, without knowing much of your config, see if this can assist in any way.

'Sign in to Microsoft Teams using modern authentication'

https://docs.microsoft.com/en-us/microsoftteams/sign-in-teams

[#3]

@ChristianBergstrom I followed this article as well. As they suggested, I have updated windows to latest version. Other than Teams, I'm able to auto-login to other MS Office apps such as Excel or Work etc.

However, Teams gives me windows auth prompt while it should auto-login as well.

[#4]

@kpsingh Hey, I'm just about to turn off my laptop. But this is a "basic authentication" prompt as far as I can tell and Teams uses modern authentication by default as well. Is this happening for all users? Please provide some additional tech details about the scenario and I will try to assist.

[#5]

@ChristianBergstrom Please see below for our configuration:

• We are using AD FS on prem and integrated it with O365 for SSO
• Client machines are domain bound which means they login to computer using their AD credentials
• Every Teams URL is added in trusted sites in IE (https://docs.microsoft.com/en-us/microsoftteams/troubleshoot/teams-sign-in/sign-in-loop)
• In IE, User Authentication > Logon is set to "Automatic logon with current user name and password"

Using above configuration, when basic authentication prompt shows up, it should automatically login to teams rather than user to enter credentials again.

This however works with other MS Office apps such as Excel.

I hope this helps more in understanding our issue.

[#6]

Hey! Sorry for the late reply (on vacation). How does the Outlook desktop clients behave when it comes to SSO?

[#7]

@ChristianBergstrom Hi, I tried with Outlook and it also seamless SSO. User don't have to enter password with Outlook as well.

[#8]

Hello, this seems odd. Does the prompt for Teams pop up every time you start Teams?

”Once you complete the sign in process using modern authentication, you won’t be required to provide your credentials again - from that point on, Microsoft Teams will automatically sign in to your account once you launch the app from the same machine.”

I am afraid I can’t assist properly as I’m on vacation. Perhaps you’d better off opening a ticket with the official MS support.

[#9 · Accepted solution]

Btw, maybe worth looking at https://docs.microsoft.com/en-us/office365/troubleshoot/sign-in/sign-in-issue-with-modern-auth

[#10]

@kpsingh Hello,

in my case this was helpful. You have to set ADFS properties to support Edge Chromium. However I don't have SSO running so I have to type login credentials.

AD FS on Windows 2016 and later:

Set-AdfsProperties -WIASupportedUserAgents @("MSIE 6.0", "MSIE 7.0; Windows NT", "MSIE 8.0", "MSIE 9.0", "MSIE 10.0; Windows NT 6", "Windows NT 6.3; Trident/7.0", "Windows NT 6.3; Win64; x64; Trident/7.0", "Windows NT 6.3; WOW64; Trident/7.0", "Windows NT 6.2; Trident/7.0", "Windows NT 6.2; Win64; x64; Trident/7.0", "Windows NT 6.2; WOW64; Trident/7.0", "Windows NT 6.1; Trident/7.0", "Windows NT 6.1; Win64; x64; Trident/7.0", "Windows NT 6.1; WOW64; Trident/7.0", "MSIPC", "Windows Rights Management Client", "Edg/*")

AD FS on Windows 2012 and earlier:

Set-AdfsProperties -WIASupportedUserAgents @("MSIE 6.0", "MSIE 7.0; Windows NT", "MSIE 8.0", "MSIE 9.0", "MSIE 10.0; Windows NT 6", "Windows NT 6.3; Trident/7.0", "Windows NT 6.3; Win64; x64; Trident/7.0", "Windows NT 6.3; WOW64; Trident/7.0", "Windows NT 6.2; Trident/7.0", "Windows NT 6.2; Win64; x64; Trident/7.0", "Windows NT 6.2; WOW64; Trident/7.0", "Windows NT 6.1; Trident/7.0", "Windows NT 6.1; Win64; x64; Trident/7.0", "Windows NT 6.1; WOW64; Trident/7.0", "MSIPC", "Windows Rights Management Client", "Edg/79.0.309.43")

More in this article https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-browser-wi... 

Hope this helps I was stuck hours in checking SSO and AD FS.

[#11]

@kpsingh Hello,

I think this should help, in my case issue was in new Edge Chromium. After I enable support AD FS for chromium it worked.

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-browser-wi... 

[#12]

Thanks so much for finding this and returning to help us all. You have saved a my hair line