I've had a Microsoft support case open for about a month, and sad to say they're not living up to my usual experience with MS support. So I'll post this here.

About a month ago, we implemented Azure AD App Proxy to front-end our on-prem Exchange 2010, so that we could do MFA for OWA and mobile devices (technically, MFA for OWA and InTune enrollment, and using conditional access on EAS to require InTune. Voila.) It's generally working great. For Outlook Anywhere and EWS, we're simply allowing passthrough authentication instead of pre-auth, because on Ex2010, those protocols won't do MFA for clients, which is fine for us.

HOWEVER - Outlook for Mac (2016) won't work anymore.

IMPORTANT EDIT - As in the title, this is only when off-site, coming in through AADAP. When they connect to the CAS server directly (when on-prem or on VPN), it works the same as it always did. Our CAS servers didn't change.

So, EWS is working. If I take my Windows machine off-prem, Outlook can still connect to EWS because I can set my OOO and see free/busy.

Outlook for Mac won't connect. It complains about Kerberos, asks me to put in new info, and never connects. With MS support, we did a SSL capture with Charles (similar to Fiddler), and they say the issue is that we allow NTLM and Negotiate in EWS, and AADAP will always and only pass the strongest method to the client, and Mac Outlook won't work with Negotiate.

As a test, last night I removed Negotiate as a Windows Auth provider in IIS on our CAS servers, and my Mac started working, now using Basic auth according to Charles. However, Windows clients off-prem stopped being able to access EWS, so OOO, MailTips, free/busy were broken. We have a lot more Windows than Mac users so we reverted. I'm still working with MS, but the Azure AD team seems to have ghosted, the Exchange guy is out of his element (no fault to him), and they never even involved the Outlook for Mac team.

Anyone have any ideas about where to start?

  • A shot into the dark, but did they checked if the server was in strict mode or compatible mode. (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL >> AllowInsecureRenegoClients && AllowInsecureRenegoServers) – yagmoth555 Apr 26 '17 at 15:21
  • It's a good question and I'll check, but the Exchange CAS server has not changed. Mac Outlook worked fine when connecting directly to CAS servers, and doesn't work when we front-end it with AADAP. – mfinni Apr 26 '17 at 15:58
  • Let me ask: which server are you referring to? The CAS server, or the AADAP proxy connector? What setting do you think it should be to make this work? – mfinni Apr 26 '17 at 15:58
  • Checking this, on all CAS servers and my Proxy Connectors, that value is not defined, so it's using the default behavior, which is to allow the older insecure method up renegotiating. Of course, what that's set to on the AADAP servers is anyone's guess. – mfinni Apr 26 '17 at 16:22
  • as it's all off, you could try another test, (after the cu update test ofcourse :)), is it working with outlook for mac 2011 ? as legally you can downgrade, and you will know if it's a problem on the office's side. – yagmoth555 Apr 26 '17 at 17:39

I had a phone call with a product manager for Azure AD a few weeks ago. They pushed a feature into App Proxy to detect Mac Office connections, and then present only the AUTH type that it can use. So, yay.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.