ADFS 2016, Exchange Online, Office 365.

[Robert Bollinger]

Hey Guys, 

Trying to understand something here. I have ADFS 2016 installed on-prem and am able to to correctly authenticate to it, when using my phone and when using OWA. 

However, what about Outlook 2016? How does that integrate with ADFS? AS a test i re-ran AD connect and selected the option to configure an existing adfs server, everything completed successfully, and i am able to auth via owa etc. 

However i also wanted to verify if ADFS was used when authenticating via Outlook and am not able to find any good info on it, for instance if i completely disable my adfs proxy server's NIC then i am still able to auth via outlook, but as expected not via OWA. 

This is a hybrid environment, with users sync'd to the cloud. 

Any ideas? 

Thanks, 

Robert 

[#2]

Outlook 2016 and above supports Modern authentication by default, meaning it can use the same auth mechanisms as the browser client. However, MA needs to be enabled both client side and server side. The easiest way to tell is to simply look at the login prompt you are getting. Or if you want to check on the AD FS server side, the audit logs should show calls to the /adfs/ls endpoint.

[#3]

@Vasil Michev 

Thanks for the response. I don't think I asked the question right. Everything is working fine, however what I wanted to know was why I was able to authenticate successfully using outlook when the ADFS server was not accessible via the internet. I can also add a new account as well, and still Auth again when my ADFS server is inaccessible. 

I have PTA auth enabled in the tenant as well, I cant figure out how to disable it, even though i turned it off via Ad Connect. 

Thanks, 

Robert 

[#4]

As long as you have a valid refresh token, the local AD FS server plays no role. Only when the token expires the client will be redirected to the AD FS server.