How to troubleshoot computer issues that limit Office 365 rich client authentication

When users try to authenticate a rich client application to Microsoft Office 365 resources from a specific client computer, one or more of the following issues occur:

• Admins can't authenticate to Office 365 by using the following management tools:
  • Windows Azure Active Directory Sync Tool (on the directory synchronization server)
  • Windows Azure Active Directory Module for Windows PowerShell (on a computer on which it is installed)
• Users can't authenticate to Office 365 by using the following rich client applications:
  • Microsoft Outlook
  • Microsoft Lync 2010
  • Microsoft Office Professional Plus
  • Microsoft Office applications

When users try to access the Office 365 portal by using a web browser from the same computer, the users may experience one of the following symptoms:

• Internet Explorer can't display the webpage.
• The user is prompted for credentials before the webpage loads.

Users don't experience these symptoms when they access Office 365 resources from other computers by using the same user account info. Users can successfully access Office 365 resources from other computers.

Usually, this issue occurs on a specific client computer or on a group of client computers. This issue may occur for all client computers only if no computers at the company are configured for Office 365. Rich client authentication may not be fully functional if Office 365 client settings aren't implemented correctly. The following Office 365 client computer scenarios may cause this issue:

• Network connectivity to Office 365 is limited.
• The firewall, proxy servers, or both require local authentication.
• Prerequisites of the rich client application aren't met.
• An old version of the Microsoft Online Services Sign In Assistant is installed.
• The rich client application isn't configured for Office 365.

Before you continue to troubleshoot this issue, make sure that all the following conditions are true:

• The keyboard on the client computer keyboard is working correctly, and the user name and the password were entered correctly.
• Rich client authentication doesn't fail for the same user account on other client computers. If all other computers experience the same symptoms for the same user account, this behavior likely indicates that the issue is related to the user account. For more info, click one of the following article numbers to view the article in the Microsoft Knowledge Base:
  2412085

  (http://support.microsoft.com/kb/2412085/ )

  You can't sign in to Office 365
• Access issues aren't limited to single sign-on (SSO)-enabled users on the client computer. If only SSO-enabled users experience access issues, there is likely an issue with the SSO configuration. For more info, click the following article numbers to view the articles in the Microsoft Knowledge Base:  
  2530713

  (http://support.microsoft.com/kb/2530713/ )

  How to troubleshoot computer issues that limit Office 365 single sign-on authentication
  2535227

  (http://support.microsoft.com/kb/2535227/ )

  A federated user is prompted unexpectedly to enter their credentials when they access an Office 365 resource
  
  2530569

  (http://support.microsoft.com/kb/2530569/ )

    Troubleshoot single sign-on implementation in Office 365

To troubleshoot this issue, use one or more of the following methods, depending on the likely cause of the issue.

Resolution 1: Network connectivity is limited

Use a browser and try to access http://www.msn.com. If you can't access this website, troubleshoot network connectivity issues.

1. At a command prompt, use the ipconfig and ping tools to troubleshoot IP connectivity. For more info about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:
   169790

   (http://support.microsoft.com/kb/169790/ )

   How to troubleshoot basic TCP/IP problems
2. At a command prompt, run nslookup www.msn.com to determine whether DNS is resolving Internet server names.
3. Make sure that the proxy server settings in Internet Options reflect the appropriate proxy server, if a proxy server is used in the local network.
4. If a Forefront Threat Management Gateway (TMG) firewall is installed on the boundary of the network and the firewall requires client authentication, you might have to install and configure the Forefront TMG client program on the client device for Internet access. Contact your Office 365 admin for help.

Resolution 2: Firewall or proxy servers require additional authentication

To resolve this issue, configure an exception for Microsoft Office 365 URLs and applications from the authentication proxy. For example, if you are running Microsoft Internet Security and Acceleration Server (ISA) 2006, create an "allow" rule that meets the following criteria: 

• Allow outbound connections to the following destination: *.microsoftonline.com
• Allow outbound connections to the following destination: *.microsoftonline-p.com
• Allow outbound connections to the following destination: *.sharepoint.com
• Allow outbound connections to the following destination: *.outlook.com
• Allow outbound connections to the following destination: *.lync.com
• Allow outbound connections to the following destination: osub.microsoft.com
• Ports 80/443
• Protocols TCP and HTTPS
• Rule must apply to all users.
• HTTPS/SSL time-out set to 8 hours

Resolution 3: Prerequisites of the rich client application aren't met, or the Microsoft Online Services Sign In Assistant is out of date

If certain operating systems or rich client applications aren't updated with the appropriate prerequisites, they may be unable to access the intended services. Make sure that the computer and the applications meet the system requirements for Office 365. For more info, go to the following Microsoft websites:

• Office 365 for enterprises:
  Software requirements for Office 365
  (http://onlinehelp.microsoft.com/en-us/Office365-enterprises/ff652534.aspx)
• Office 365 for professionals and small businesses:
  Software requirements for Office 365
  (http://onlinehelp.microsoft.com/en-us/office365-smallbusinesses/ff652564.aspx)

The easiest way to make sure that your computer is updated appropriately for Office 365 is to run the Office 365 Desktop Setup Tool. To do that, follow these steps:

1. In a web browser, browse to https://portal.microsoftonline.com
   (https://portal.microsoftonline.com)
   , sign in, and then click Downloads in the right pane.
2. Scroll to the bottom of the page. Under 3 Set up and configure your Office desktop apps, click Set up, and then confirm when you are prompted to run the Office 365 Desktop Setup Tool. 

Or, you can download and manually install the required updates and packages from the following Microsoft website:

Resolution 4: The rich-client application isn't configured for Office 365

If profiles haven't been created for some rich-client applications, those applications will be unable to correctly access the intended services. The easiest way to make sure that applications are configured appropriately for Office 365 is to run the the Office 365 Desktop Setup Tool: 

1. In a web browser, browse to https://portal.microsoftonline.com
   (https://portal.microsoftonline.com)
   , sign in, and then click Downloads in the right pane.
2. Scroll to the bottom of the page. Under 3 Set up and configure your Office desktop apps, click Set up, and then confirm when you are prompted to run the Office 365 Desktop Setup Tool.

Or, you can manually configure application profiles. For more info, see the following Microsoft website:

For more info about issues with specific rich client applications in Office 365, click the following article numbers to view the articles in the Microsoft Knowledge Base:For information about the supported client applications for use together with Office 365 on a Macintosh computer, click the following article number to view the article in the Microsoft Knowledge Base: