Outlook and SSO

[Dave Durand]

I have an O365 tennant with Azure AD being the only directory source.  If I join a machine to Azure AD, thus requiring the Azure AD sign-on to be used for login, should Outlook be able to sign-in automatically?  It appears to do this for Teams and SharePoint from what I can see however Outlook isn't working this way and users are prompted with AzureAD\useraccount for the username and to enter their password.  Does another app need to be set in Azure for SSO aside from the defaults which are there?  I believe it impacts Skype for Business as well for the original sign-in prompt as well as the Exchange-integrated prompt.

The objective is to ensure logged in users to an AzureAD-connected Windows 10 workstation are not prompted for credentials to access Office365 services at a minimum.

Is there a good reference document to accomplish this?

Dave

[#2]

Hi Dave

I would suggest you to refer the below article...

https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Join-on-Windows-10-d...

And would suggest to send a message to Alex Simons, if further questions. As according to the post SSO seems possible for Outlook in Azure AD joined machines.

Thanks

Robin Nishad

--------------------

Technical Consultant

[#3 · Accepted solution]

Do you have Modern Authentication enabled for Exchange Online?

https://support.office.com/en-gb/article/enable-or-disable-modern-authentication-in-exchange-online-...

[#4]

Victor, I happened to notice your reply first due to my slow email reading today and I did notice that for this tennant OAuth2 was set to $false.  I've adjusted the setting and will test.  I knew it was something simple for starters and recall reading about the Modern authentication option...I simply didn't connect the dots.  I'll chime in with test results when I have them.

[#5]

For the record, modern authentication was set to 'false' for this tenant, thus the issue I encountered.  As soon as I enabled, it worked as expected.

[#6]

You should also enable it for Skype for Business, if you haven't already. It is even recommended to have it enabled both for Exchange and Skype. https://social.technet.microsoft.com/wiki/contents/articles/34339.skype-for-business-online-enable-y...

As it says in the article, Modern Auth is enabled by default for new tenants since 2017 August 1. So i guess your tenant is older (like mine was). As we are using local AD, i also had to add SIP address for a user into ProxyAddresses attribute for Skype to find correct username automatically, but in your case this is probably not needed.