outlook for mac not working with azure mfa

Outlook Not Working With Azure Mfa Mac Outlook Clients

After i enroll a user in MFA, the auto discover fails to work.

If i a run a Outlook Auto Discover test on a non MFA user it connects fine, on a MFA enabled user it fails.

I have searched online for this i cannot see anyone else having this issue.

If i setup the user Outlook first, and then enable MFA for them, it continues to work fine.

Does anyone have an idea, or seen this before 11 comments share save hide report 89 Upvoted This thread is archived New comments cannot be posted and votes cannot be cast Sort by best level 1 3 points 1 year ago Where does it fail Do you get the ADAL Prompt Window Or a basic auth Window Does it fail after kerbpassword and during the MFA portion Need more data, a description of the client behavior.

Federated or managed domain level 1 Comment deleted by user 1 year ago level 2 Original Poster 1 point 1 year ago Modern Auth is enabled.

Effected user are running the newest version of the Office 365 apps.

Outlook Not Working With Azure Mfa Mac Outlook Clients

Mobile devices and Mac Outlook clients worked just fine and used MFA, Outlook for Windows did not.

It took a ridiculous amount of wasted time and research before I discovered this article: Enable modern authentication in Exchange Online the 3rd bullet point states: Other email clients that support modern authentication (for example, Outlook Mobile, Outlook for Mac 2016, and Exchange ActiveSync in iOS 11 or later) always use modern authentication to log in to Exchange Online mailboxes, regardless of whether you enable or disable modern authentication for Outlook 2013 or later clients as described in this topic.

Try using an app password on an affected Outlook client to see if that works.

If it does then it maybe Modern Authentication isnt turned on.

What we are seeing is a brief moment where it looks like Modern Auth is supposed to present a window but then goes away before you even see it.

We are running Azure AD Sync with Seamless SSO enabled, hash syncronization.

After trying the basic stuff like clearing the cached credentials, I started digging into non-obvious stuff.

Here are my notes: Removed the registry key disabling ADAL auth since it is required for Multifactor authentication Tested Autodiscover both from Outlook and from the Remote Connectivity Analyzer and found that it is failing after the redirect to Determined that it could potentially fail if the password is not complex enough, but the current password appears to meet complexity requirements Checked the hosts file to see if the autodiscover requests were being forwarded somewhere else, they were not Disabled IPv6 in case IPv6 routes to the autodiscover servers werent working as expected Checked ADSIEdit on the server for legacy Exchange Autodiscover pointers, there were none Found an article indicating that if autodiscover works for some users and not others, it could be a result of inheritance being disabled on their user object in Active Directory Determined that User was in fact the only end user in the organization to be a member of the Domain Admins group, which intrinsically removes inheritance Used an inheritance fix up script to correct this issue on the account Forced a resync to Azure and tested autodiscover again, still fails Removed cached autodiscover entries from users Outlook profile in appdataMicrosoftOutlook, this caused the linked accounts to stop working but the main account still wouldnt connect Checked proxy addresses in ADSIEdit to make sure user didnt have an old email address cached in there, she did not Set various autodiscover related settings in the registry in an attempt to get around the current issue, no avail The error codes returned by the Remote Connectivity Analyzer are LiveIdSTS logon failure- recovery possible 0x800434D4 AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi factor authentication to access The first error indicates that there is a liveid that it is attempting to login to to retrieve autodiscover information The next two errors are usually found in the context of troubleshooting other types of authentication, like using a outdated PowerShell module to access the Azure API authenticating with an account that has Multi-Factor Enabled.

There errors are generally not related to Outlook authentication Next Steps Remove users email from from her personal live id so it cant attempt to retrieve autodiscover information from that directory Open a ticket with Microsoft level 1 1 point 1 year ago Enable Legacy Auth in the registry for the affected users.

View entire discussion ( 11 comments) More posts from the Office365 community Continue browsing in rOffice365 rOffice365 A vast community of Microsoft Office365 users that are working together to support the product and others.

Members 469 Online Created Apr 14, 2012 Join help Reddit App Reddit coins Reddit premium Reddit gifts about careers press advertise blog Terms Content policy Privacy policy Mod policy Reddit Inc 2020.

Outlook For Mac Not Working With Azure Mfa