Windows Mac OS X Office Clients Skype for

Windows Mac OS X Office Clients Skype for Business Outlook One. Drive for Business

Access Token Exchange Online Identity Provider (Evo. STS) Authentication stack HTTP transport stack ADAL

Azure Active Directory Okta Optimal IDM Virtual Identity Server Federation Services One. Login Ping.

Identity Provider (Evo. STS) Multi-Factor Authentication Directory

POST https: //outlook. office 365. com/mapi/emsmdb/? Mailbox. Id=agd 3482 b 1 -d 18 e-4

HTTP/1. 1 401 Unauthorized request-id: f 910 d 760 -5 a 2 f-4457 -bade-5671824

HTTP/1. 1 200 OK Connection: Keep-Alive Content-Length: 16056 Expires: -1 Date: Wed, 20 Apr

HTTP/1. 1 200 OK Content-Type: application/mapi-http request-id: 7 d 8640 e 6 -9 d

Access/refresh token exchange POST https: //outlook. office 365. com/mapi/emsmdb/? Mailbox. Id=9115876 0 -975 b-4018

http: //aka. ms/Exo. Modern. Auth https: //aka. ms/Skype. Power. Shell

4000000; reason="Flighting is not enabled for domain ‘john. doe@contoso. com'. "; error_category="oauth_not_available“ Latest: ADALIdentity:

Compact Token Exchange Online SAML Token Identity Provider (Org. ID) Directory User Authentication Identity

Outlook 2016 works, Outlook 2013 does not

2016/09/22 13: 40: 37: 962: : [6620] Identity. Liblet: Try. To. Enable. ADAL not

https: //technet. microsoft. com/en-us/library/jj 683102. aspx

https: //testconnectivity. microsoft. com/

Office Configuration Analyzer Office Sign-in Assistant Test Connectivity Scenarios Office 365 Client Performance Analyzer

http: //myignite. microsoft. com https: //aka. ms/ignite. mobileapp

Slides: 82

Download presentation

Windows Mac OS X Office Clients Skype for Business Outlook One. Drive for Business Legacy clients Office 2007 Office 2010 Windows Phone i. OS Android

Access Token Exchange Online Identity Provider (Evo. STS) Authentication stack HTTP transport stack ADAL MSO Web Browser Directory SAML Token Access and Refresh Tokens Identity Provider (AD FS or other) Directory

Modern Auth (Federated Identities)

Modern auth (Federated Identities)

Azure Active Directory Okta Optimal IDM Virtual Identity Server Federation Services One. Login Ping. Federate 6. 11 Net. IQ Access Manager 4. 0. 1 Ping. Federate 7. 2 BIG-IP with Access Policy Manager BIG-IP ver. 11. 3 x – 11. 6 x Ping. Federate 8. x VMware Workspace Portal version 2. 1 Centrify Sign&go 5. 3 IBM Tivoli Federated Identity Manager 6. 2. 2 Ice. Wall Federation Version 3. 0 Secure. Auth Id. P 7. 2. 0 CA Secure Cloud CA Site. Minder 12. 52 Dell One Identity Cloud Access Manager v 7. 1 Radiant. One CFS 3. 0 Auth. Anvil Single Sign On 4. 5

Multifactor Authentication?

Identity Provider (Evo. STS) Multi-Factor Authentication Directory

Modern auth (Federated Identities)

POST https: //outlook. office 365. com/mapi/emsmdb/? Mailbox. Id=agd 3482 b 1 -d 18 e-4 cae-952 b 5 ad 875 ase 3 e 3 bd@contoso. com HTTP/1. 1 Content-Type: application/mapi-http Accept: application/mapi-http Authorization: Bearer User-Agent: Microsoft Office/15. 0 (Windows NT 6. 3; Microsoft Outlook 15. 0. 4783; Pro) Client-Request-Id: {5 A 866872 -7 E 74 -440 E-88 C 9 -48 D 30 A 6 DBB 41} X-Client. Application: Outlook/15. 0. 4783. 1000 X-User-Identity: john. doe@contoso. com X-Request. Id: {8 E 871543 -8042 -420 E-95 F 2 -F 170 DF 1 D 6 E 62}: 1 X-Request. Type: Connect Host: outlook. office 365. com

POST https: //outlook. office 365. com/mapi/emsmdb/? Mailbox. Id=agd 3482 b 1 -d 18 e-4 cae-952 b 5 ad 875 ase 3 e 3 bd@contoso. com HTTP/1. 1 Content-Type: application/mapi-http Accept: application/mapi-http Authorization: Bearer User-Agent: Microsoft Office/15. 0 (Windows NT 6. 3; Microsoft Outlook 15. 0. 4783; Pro) Client-Request-Id: {5 A 866872 -7 E 74 -440 E-88 C 9 -48 D 30 A 6 DBB 41} X-Client. Application: Outlook/15. 0. 4783. 1000 X-User-Identity: john. doe@contoso. comb X-Request. Id: {8 E 871543 -8042 -420 E-95 F 2 -F 170 DF 1 D 6 E 62}: 1 X-Request. Type: Connect Host: outlook. office 365. com

HTTP/1. 1 401 Unauthorized request-id: f 910 d 760 -5 a 2 f-4457 -bade-5671824 e 8576 X-Calculated. BETarget: DM 2 PR 06 MB 848. namprd 06. prod. outlook. com X-Back. End. Http. Status: 401 X-Request. Id: {8 E 871543 -8042 -420 E-95 F 2 -F 170 DF 1 D 6 E 62}: 1 X-Diag. Info: DM 2 PR 06 CA 9994 X-BEServer: DM 2 PR 06 CA 9994 X-FEServer: SN 2 PR 80 CA 033 WWW-Authenticate: Bearer client_id="00000002 -0000 -0 ff 1 -ce 00 -000000", trusted_issuers="00000001 -0000 -c 000 -000000@*", token_types="app_asserted_user_v 1 service_asserted_app_v 1", authorization_uri="https: //login. windows. net/common/oauth 2/authorize", Basic Realm=""

Modern auth (Federated Identities)

HTTP/1. 1 200 OK Connection: Keep-Alive Content-Length: 16056 Expires: -1 Date: Wed, 20 Apr 2016 14: 27: 56 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-HTTPAPI/2. 0 Cache-Control: no-cache, no-store Pragma: no-cache x-frame-options: DENY <!DOCTYPE html> <html lang="en-US"> < …ADFS Forms Based Auth page code…> </html>

HTTP/1. 1 200 OK Content-Type: application/mapi-http request-id: 7 d 8640 e 6 -9 d 97 -4013 -b 98 e-b 1 eb 6448 bbf 5 X-Back. End. Http. Status: 200 Set-Cookie: Mapi. Routing=Ul. VNOjcw. Nm. Vk. N 2 Nk. LTc 1 Mj. Mt. NDIx. MS 1 h. YTk 2 LTdl. NWQ 3 Yj. Bj. ODI 3 MDqkiig+hn 7 TCA==; path=/mapi/; secure; Http. Only Set-Cookie: Mapi. Context=MAPIAAAAAOer/q 78 zf. W 4+sr+zvr. Z 69 vq 3 PHB 9 Nno 3//P+ML 3 xvz. N+KKBs 4 Kwi. LGHvoa 2 gag. OAAAA; path=/mapi/emsmdb; secure; Http. Only Set-Cookie: Mapi. Sequence=0 -UO 0 MYQ==; path=/mapi/emsmdb; secure; Http. Only X-Request. Type: Connect

Access/refresh token exchange POST https: //outlook. office 365. com/mapi/emsmdb/? Mailbox. Id=9115876 0 -975 b-4018 -a 0 cb-cb 562919 d 98 e@contoso. onmicrosoft. com HTTP/1. 1 Content-Type: application/mapi-http Accept: application/mapi-http Authorization: Bearer ey. J 0 e. XAi…

Access/refresh token exchange

Access/refresh token exchange

Modern Auth Not working

http: //aka. ms/offcat

http: //aka. ms/Exo. Modern. Auth https: //aka. ms/Skype. Power. Shell

4000000; reason="Flighting is not enabled for domain ‘john. doe@contoso. com'. "; error_category="oauth_not_available“ Latest: ADALIdentity: : Is. ADALDisabled. Via. Exchange. Flighting returning true

Outlook Disconnected at Startup

Outlook Disconnected at Startup

Compact Token Exchange Online SAML Token Identity Provider (Org. ID) Directory User Authentication Identity Provider (AD FS or other) Directory

Compact Token Exchange Online SAML Token Identity Provider (Org. ID) Directory User Authentication Identity Provider (AD FS or other) Directory

Claims Rules

Outlook 2016 works, Outlook 2013 does not

3085565

2016/09/22 13: 40: 37: 962: : [6620] Identity. Liblet: Try. To. Enable. ADAL not enabling ADAL 2016/09/22 13: 40: 37: 962: : [6620] Identity. Liblet: not enabled due to Use. Online. Content setting 2016/09/22 13: 40: 37: 962: : [6620] Identity. Manager: skipping Offline. Init because liblet is disabled

https: //technet. microsoft. com/en-us/library/jj 683102. aspx

http: //aka. ms/icesdptool

https: //diagnostics. outlook. com/#/

https: //testconnectivity. microsoft. com/

Office Configuration Analyzer Office Sign-in Assistant Test Connectivity Scenarios Office 365 Client Performance Analyzer

http: //fasttrack. microsoft. com/

http: //techcommunity. microsoft. com

http: //myignite. microsoft. com https: //aka. ms/ignite. mobileapp