- The perimeter device uses preauthentication.
- The firewall is blocking required IP addresses from accessing on-premises servers in your environment.
- You have an internal DNS domain that's configured to block forwarding and that's missing the DNS record for Autodiscover.
- You're experiencing general on-premises configuration issues.
Perimeter device uses preauthenticationTo troubleshoot preauthentication issues on a perimeter device, see Configure Forefront TMG for a hybrid environment.
Firewall is blocking required IP addresses from accessing on-premises serversReview the IP address and URL requirements for Office 365 at Office 365 URLs and IP address ranges.
You have an internal DNS domain that's configured to block forwardingAdd an A record for the Autodiscover URL (for example, Autodiscover.contoso.com) to the internal DNS record, and then point that record to the on-premises Client Access server.
General on-premises configuration issuesFor information about how to troubleshoot general on-premises issues, see Troubleshoot a hybrid deployment.
Article ID: 3087170 - Last Review: Dec 21, 2016 - Revision: 1