Office 365: Outlook 2016 password prompts in an Exchange hybrid environment

Outlook prompted for a password when a user tried to open a resource calendar that had been migrated to Exchange Online. The user's mailbox was still on the on-premises Exchange server, while the resource mailbox was now in Exchange Online.

The Windows Security dialog showed "Windows Security - Microsoft Outlook connecting to …"

Following the authentication request

Inspecting the HTTPS traffic with Fiddler or a similar tool shows Outlook being redirected to Exchange Online through Autodiscover. This happens when opening the calendar from the address book or using the cached entry.

The request to https://outlook.office365.com/mapi/emsmdb/?mailboxId= returned HTTP 401 Unauthorized:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/10.0
request-id: 479b1adc-58e4-468f-ae61-97a9546896e2
X-CalculatedBETarget: .PROD.OUTLOOK.COM
X-BackEndHttpStatus: 401
Set-Cookie: MapiRouting=UlVNOjRmZmViZjBlLTFjNjYtNDhkNC1iZDI5LTRhYmY5YTE1M2QyYzpgsMpVJJPVCA==; path=/mapi/; secure; HttpOnly
X-ServerApplication: Exchange/15.20.0609.000
X-RequestId: {1D86915E-1150-4DB3-A9F5-D436880F173F}:1
X-ClientInfo: {D16372AD-A1DC-4910-85DE-7BCEBEE30D63}:211640033
X-RequestType: Connect
X-DiagInfo: MB0064
X-BEServer: MB0064
X-Powered-By: ASP.NET
X-FEServer: AM5
WWW-Authenticate: Bearer client_id="00000002-0000-0ff1-ce00-000000000000", trusted_issuers="00000001-0000-0000-c000-000000000000@*", token_types="app_asserted_user_v1 service_asserted_app_v1", authorization_uri="https://login.windows.net/common/oauth2/authorize",Basic Realm="",Basic Realm=""
Date: Mon, 26 Mar 2018 14:17:40 GMT
Content-Length: 0

Enabling modern authentication for Autodiscover

After several hours of analysis and troubleshooting, I found the issue. I was using Outlook 2016 from an Office 365 ProPlus installation. My mailbox was on the on-premises Exchange server, and I was trying to access a service in Exchange Online. The connection needed modern authentication or prompted me to enter credentials and save them locally. Saving the credentials worked, but I did not want to rely on that in a large enterprise environment.

In this configuration, Outlook limited its authentication choices to the schemes supported by RPC, which did not include modern authentication. I resolved this by adding the following registry setting to the user profile. This applied to Outlook 2013 and Outlook 2016; Outlook 2010 did not support modern authentication and still required a username and password.

1. In Registry Editor, locate HKEY_CURRENT_USER\Software\Microsoft\Exchange.
2. On the Edit menu, point to New, then click DWORD Value.
3. Type AlwaysUseMSOAuthForAutoDiscover and press Enter.
4. Right-click AlwaysUseMSOAuthForAutoDiscover and click Modify.
5. In the Value data box, type 1 and click OK.
6. Exit Registry Editor and restart Outlook.

This was a significant issue for the migration project. Some locations were still using on-premises Exchange, while others had migrated to Exchange Online. The registry change helped me avoid additional helpdesk questions and user communication during the migration.

References

• Outlook prompts for password when Modern Authentication is enabled