Exchange server 2016 authenticate with Kerberos require Outlook 2016 input password when connect mailbox

Question

Hello everyone,

Currently, our organization run Exchange Hybrid mode, we deploy Windows Hello for Business, user with on-premise mailbox will connect to Exchange Server using Kerberos. After complete deployment, we encounter issues when user with on-premise mailbox connect to Exchange, Outlook 2016 prompt require input passwords, i cancel prompt and double click to Need Password, Outlook 2016 can connect to Exchange.

Bellow is result my checked:

1. "Negotiate" configured for both Outlook Anywhere and MAPI virtual directories, I only have 01 server.
2. Get-MapiVirtualDirectory | Fl authen,InternalUrl,ExternalUrl
   IISAuthenticationMethods : {Ntlm, OAuth, Negotiate}
   InternalAuthenticationMethods : {Ntlm, OAuth, Negotiate}
   ExternalAuthenticationMethods : {Ntlm, OAuth, Negotiate}
   InternalUrl : https://mail.mydomain/mapi
   ExternalUrl : https://mail.mydomain/mapi
3. Get-OutlookAnywhere| fl InternalClientAuthenticationMethod, authen,InternalUrl,ExternalUrl
   InternalClientAuthenticationMethod : Negotiate
   ExternalClientAuthenticationMethod : Negotiate
   InternalClientAuthenticationMethod : Negotiate
   IISAuthenticationMethods : {Basic, Ntlm, Negotiate}
4. Get-OrganizationConfig | Fl MapiHttpEnabled
   MapiHttpEnabled : True

Our server run hybrid mode, but OAuth disabled on my server.

I also check configure Kerberos follow link Configure Kerberos authentication for load-balanced Client Access services | Microsoft Learn, i correct configure, Negotiate occur in RpcHttp, HttpProxy, Autodiscover logs. But result of klist only have http/mail.mydomain.com, does not have http/autodiscover.mydomain.com

We only encounter this issues with Outlook 2016, our environment: Exchange Server 2016 CU22, configure Hybrid Wizard Exchange, Outlook 2013 doesn't impact by issues.
Please help me solve this issues.

Answer 1

I suspect:

ExcludeExplicitO365Endpoint is coming into play here:

https://learn.microsoft.com/en-us/outlook/troubleshoot/profiles-and-accounts/unexpected-autodiscover-behavior

try adding these Reg Keys to a worksation and test to see if that goes away:

https://gist.github.com/ridercz/dc485d38da104835559c1ed8b78afad0

Another article:
https://medium.com/jj365/outlook-issue-with-direct-connect-to-office365-352dd29de65

Answer 2

After I update Outlook 2016 by KB5001998, Outlook 2016 doesn't popup require password for access mailbox.
Thanks for all support me.