Supporting Integrated Windows Authentication Clients
Topic Last Modified: 2013-06-22
After two-factor authentication web browser settings have been applied to the client to enable seamless interaction with the Outlook Web App feature of Exchange Online, a single sign on experience for the client will be possible. If a user is prompted for credentials, several aspects of the user’s environment should be examined before placing a request with Microsoft for support.
|As already indicated, Microsoft only provides support for the Internet Explorer web browser. The instructions that follow are generalized and the use of Internet Explorer is illustrated as an example. Specific error messages, user interface windows, and modification procedures for other web browsers must be obtained from the manufacturer of the browser.|
Two forms of authentication failure are the most common: (1) no prompt for credentials and an incomplete authentication process or (2) a prompt for credentials and a successful or unsuccessful manual completion of the authentication steps.
If no prompt for credentials occurs, the fault is likely to be the client, network, or Exchange Online environment. If the client and network appear to be operating satisfactorily, a service request can be placed with Microsoft support.
If a prompt for credentials appears, as shown below, the configuration of the client system is likely to be incorrect.
Selecting the Cancel button produces the following message:
Use the following steps to attempt to resolve the authentication issue before contacting Microsoft support:
Confirm that the user has manually entered correct credentials for the correct account domain within your Customer Forest.
Confirm the client system is connected to the corporate network (intranet or VPN) and that the client workstation is joined to the correct account domain within your Customer Forest (use set USERDOMAIN command within a command prompt window on the client system to view the domain setting).
For an Internet Explorer user, confirm the Outlook Web App URL for Exchange Online appears in the Intranet Zone for the browser as described in the section Establishing a Single Sign-on Experience for Intranet Clients.(Follow similar verification steps for other browsers.)
For an Internet Explorer user, confirm the Integrated Windows Authentication attribute is enabled within Internet Explorer as in the section Establishing a Single Sign-on Experience for Intranet Clients.(Follow similar verification steps for other browser types.)
If the user continues to be prompted for credentials, instruct the user to attempt to use the Outlook client instead of Outlook Web App to access Exchange Online and note the result.
If user access is not successful at any point when using these steps, include the result of each verification step in the service request placed with Microsoft support.