2

How do local Microsoft Office applications (Word, Excel, etc) authenticate with Office 365? If I open, say, Excel or Word, then my name and email address automatically appears in the top-right hand corner and I create local/cloud documents from the get-go. However, if I open Outlook or Lync, I have to authenticate. Does anybody know what's happening here?

For background: I've set-up a trial Office 365 account to play around with the functionality and learn what it does. So far, I have configured my Windows domain, set-up a bunch of users, configured DirSync, configured password sync, configured Federation Services and everything works great. I log on to my domain computer, open the browser, hit http://login.microsoftonline.com/, enter in my federated user, it redirects me to the ADFS server and I'm in. Happy days - no passwords.

However, I'm not sure where I stand with local apps. I would, where possible, like to authenticate using ADFS and avoid entering username/passwords. Could somebody elaborate on what my options are?

|improve this question
1

There's no option to use SSO for Outlook, becuase Exchange Online expects you to use basic authentication. I suspect Office365 (2013) doesn't use true SSO either, just a federated login. When you use office for the first time it ask for your credentials and remembers them for you. You can check this in Windows Credential Manager. You can do the same with Outlook.

If you've configured ADFS then it's aways used for federated accounts, it just a question of whether or not your credentials are automatically passed through to your ADFS server. It seems that only the web-based applications support true single sign-on and even then you have to use smart links so that it knows exactly who you want to interact with the application as.

|improve this answer
  • Lync/Skype for Business is more of the same. It needs credentials to talk to Exchange, and therefore another entry in Credential Manager. – blaughw Nov 11 '15 at 4:31
  • The Office client itself can also sign into the subscription service automatically if the user IDs line up properly. This might not be setup in a test environment. – blaughw Nov 11 '15 at 4:37
0

There is an update to this issue. Skype for Business and Exchange Online can now be enabled for OAuth 2.0. This needs to be done at the service level. This enables the Office suite to use "Modern Authentication" like the rest of the services, including Multi-Factor Authentication through Azure AD.

Exchange Online:

Connect to Exchange Online and run the following cmdlets:

Set-OrganizationConfig -OAuth2ClientProfileEnabled:$true

Get-OrganizationConfig | ft name, *OAuth*

Skype for Business Online

Set-CsOAuthConfiguration -ClientAdalAuthOverride:$True

Get-CSOauthConfiguration

Content from: https://technet.microsoft.com/en-us/library/mt710548.aspx

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.