Classic outlook authentication via hotspot

[winthermyrland]

I've recently implemented the entire WIN OIB baseline for out windows machines (with exception of passwordless config), I've done some edits to suit our needs.

I've figured out all the "issues" we've had so far but one. For some reason, when some, not all, users are using mobile hotspot or their own Wi-Fi at home to work on the fly, Classic Outlook fails to authenticate. I tried fiddle some with the kerberos exchange server and all but cannot find the cause for this. We have EXO only so no hybrid exchange, users are synced from onprem to Azure and the devices are only enrolled in intune, they are not part of the onprem domain, we use kerberos cloud ticket magic for our users to authenticate to our onprem servers.

Any clue to what the cause could be? I've combed through the settings but can't find a cause, most of our users don't have this issue but about 5% do.

First time I use github discussions and I hope asking this question here is okay.

A part from this small issue, I want to say good job with this baseline. OIB really is a game changer for IT departments too small managing companies too large.

[SkipToTheEndpoint]

Hey! Firstly, thanks for the kind words, and I'm so happy you've found it so beneficial!

This sounds like a really curious issue. The only policies that I can think might interact with that at all are "Automatically configure profile based on Active Directory Primary SMTP address" (which is only relevant the first time a profile is created, and "Prefer the provided account email in AutoDiscover auth prompts.".
Even then, neither of those should really do anything once a profile has been successfully configured.

There's obviously a lot that could be at play here, from the actual network peering to conditional access and broader EXO config. If you're purely EXO then Kerberos shouldn't even really play a part in that either.
This doesn't feel like a policy issue, and without being able to troubleshoot more broadly, it's difficult to be able to guide toward a potential fix.

[winthermyrland]

Thank you so much for your reply.

Yeah the issue seems very strange. One related issues was found today actually, using hotspot and connecting to Cisco AnyConnect VPN fails just as the classic outlook does, but everything else on the clients work.

Most difficult part of this troubleshooting is that it works flawlessly on all my machines and test machines that have exact same config as the users reporting this problem. We even wiped one of the users machine as a last resort, but that didn't fix the issue.

I will conduct some tests with the configs that you mentioned, but since I learned that even a Cisco AnyConnect VPN profile fails, that means its not related to just classic outlook. I will be sure to share my findings here if I can resolve it.

[winthermyrland]

Workaround is to use the new outlook. We told our users to just switch over and blamed Microsoft, after a month of troubleshooting we could not find the cause.

Case closed.