Forum Discussion
Multi-factor Authentication breaks outlook
Doing this the APP is now using the users network pass instead of the APP Password.
Christian Taveras years later (though this thread was still active only a couple of months ago) I have one more potential culprits and an actual solution versus a work around/hack - for everyone's sake hopefully its the solution once and for all, as it should take you 5 minutes to make a single global change.
The solution came from continual link following from one of the replies above to Microsoft, back to other forums and in a loop but I pieced together the actual problem and was able to then find the solution. I figured I'd post this to help someone to cut to the chase versus having to following the same rabbit hole I did. I tried SaRA to no avail (just like with a couple of your tenants) and recreating the windows profile was the only solution that seemed reliable - not really an organization wide option.
I noticed, like you, I had a problem with some users, not all. I subsequently identified these users were all older tenants. I then found an article from Microsoft that said "For tenants created before August 1, 2017, modern authentication is turned off by default for Exchange Online and Skype for Business Online."
Essentially, try as you may with local options when your tenant attempts to authenticate with Exchange Online, O365 is forcing Outlook to use basic auth, not modern auth. So your "switch flicking" from SaRA did something server side not local or it changed something in the local registry that ignored O365 asking for Basic Auth. This could explain why registry hacks work. Andrios, iOS, and OSX applications only have modern auth so they cannot have the problem (
only the application native to a Microsoft Operating system).
Solution... force all users to Modern Authentication. In retrospect this makes sense as I've noticed new users always got the modern auth prompt even before trying to implement MFA while the old timers like myself had basic auth prompts still pop up occasionally.
Note: this assumes you are on 2016/Outlook for Office 365, 2013 users still additionally have to enable ADAL with registry changes first, then you follow the instructions below to enable modern auth with Exchange Online-> https://support.office.com/en-us/article/enable-modern-authentication-for-office-2013-on-windows-devices-7dc1c01a-090f-4971-9677-f1b192d6c910
Solution in detail:
Run Powershell - here is another gotcha, in a fun Microsoft twist of irony if you have MFA enabled for this user you will have to download the Microsoft Exchange Online Remote Powershell Module to get modern auth in the powershell environment. If your username can log in with basic auth, search->powershell->run as admin.
Connect to Exchange Online in PowerShell
Connect-EXOPSSession -UserPrincipalName mailto:chris@contoso.com
(for US based Office 365 - for others, you will need to find the URIs)
Enable Modern Authentication in Exchange Online
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
Check Status of Modern Authentication
Get-OrganizationConfig | Format-Table Name,OAuth* -Auto
PS C:\Users\StevenOsuch> Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
PS C:\Users\StevenOsuch> Get-OrganizationConfig | Format-Table Name,OAuth* -Auto
Name OAuth2ClientProfileEnabled
---- --------------------------
domain.somewhere.com True
Now open up Outlook, it worked instantly, I didn't even have to provide credentials as it pulled it from my laptop which already had the SSO profile that had been authenticated at login.
Retrospectively, looking at the Set-Up MFA for O365 article (https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide), it mentions this as well but this was just updated a couple of days ago so maybe it wasn't there before.
Final note, if you still use Skype for Business, you have to enable Modern Auth separately using the Skype specific connection and command prompts.