Authentication Failure

Question

We are Office 365 clients with E3 licenses using ADFS

We are also configured with multi factor authentication with rules to not require MFA if access from inside our private network.  everyone is using Office 2103 locally installed on devices.  This has been setup for a couple months now. 

Even though we are MFA with exception rules for our private network, we are required to provide the "App Passcode" for the Office apps (non web apps).  We have registered and been configured for ADAL, but since it requires a "local user" registry hack, we have only deployed ADAL to a couple people for testing. 

Anyway, just providing some background, now for the problem

I installed Windows 10 at home, then installed Office 2016.  Everything worked perfectly.  I was able to connect when on our VPN and when not on the VPN.  Honestly can't remember if I needed to provide the App Passcode, I think it was just my normal AD password.

I've been on 10 for a couple weeks now, and suddenly I'm not able to connect my Office apps to my O365 services.  Outlook loads and says it needs my password.  I click the account type (work account) and then get an error.  I've included the error screen.  I'm getting this in everything, Outlook and Skype, etc.  I uninstalled and re installed, same issue

Meanwhile, my Surface with 8.1, I updated with Office 2016 a few weeks ago and everything was fine.  Suddenly I'm getting the same issue as on my 10 pc.  I uninstalled and installed 2013 on my Surface, and I connected immediately without even asking me for authentication.

Any ideas on what is going on?

Thanks

Answer 1

rebooted ad fs server, still had problem.  didn't see anything in event log.  removed all my work related creds in credential manager, still had problem.  

deleted my outlook mail profile and everything started working, including skype.  It didn't even go through the initial setup, which is odd

seems to be working at this point.  not sure what fixed it though, which is always disappointing

thanks for taking me through some steps however

Answer 2

Hi Bradley,

Thanks for the clarification.

Regarding point 5, I would like to confirm if you restart ADFS server after you select form based authentication for Intranet. 

After checking the screenshots, it seems the issue could be caused by the connection between the computer and ADFS server. To further analysis, I need to check the following things:

1.  When the login issue occurs, could you find any error in ADFS event log?
2.  What if you remove all credentials in Credential Manager from Control panel?
3.  Can you login to Office 365 portal(portal.office.com) using the federated account?

Regards,

Johnny Zhang

Answer 3

i'm having trouble seeing how to upload multiple images


Answer 4

Hello

1. I thought we were on 2.0, but in my effort to confirm, it appears we are running 3.0.  It is a Win 2012 R2 server
2. I don't know how to know.  It is a new install of Win 10 and Office 2016 with nothing previously installed.  All I did was launch Outlook and login
3.  I've uploaded a series of images.  

Image1.jpg shows Outlook has opened and in the status bar at the bottom it says "need password"

Image2.jpg shows the screen I get when I click "need password"

Image3.jpg is a repeat of what I provided previously, and is the next thing I get.

Image4.jpg shows the Account Info screen

4. image8.jpg shows the error when launching Skype.  This comes up while the client is trying to connect
5. Image5.jpg shows AD FS configuration as it was up to this point.  I went ahead and checked the "forms authentication" box for Intranet and tried again

Image6.jpg shows Outlook status with the Forms thing checked.  If I click anywhere on Outlook at this point, the whole screen grays out and locks up.  I have to use Task Manager to close (see Image7)

Additional Information - I launched Outlook in Safe Mode and it loaded and allowed me to authenticate using the App Passcode.  It loaded properly and my Inbox updated with recent messages.

Answer 5

hi bradley,

from your description, this sign-in issue only occurs on windows 10 + office 2016. may i collect some information to analyze the issue?

1. what is your adfs version? adfs 2.0, or adfs 3.0 (come with windows server 2012 r2)?
2. when working on this windows 10 pc, are you using adal based authentication?
3. regarding “outlook loads and says it needs my password”, do you mean:

configure exchange online account in outlook client

or

sign into office here:


4. what is the error when you sign into skype for business using office 365 account? a screenshot is appreciated.
5. upon researching, for adal based modern authentication, we need to have forms-based authentication enabled on the ad fs server. please make sure forms-based authentication is enabled.

with the detailed information, i will further check the issue.

thanks,

young