Signing in to Office 365, Azure, or Intune by using single sign-on doesn't work from some devices

Resolution 1: Can't connect to cloud service portal or to AD FS 

Try to browse to http://www.msn.com. If this doesn't work, troubleshoot network connectivity issues. To do this, follow these steps:

1. At a command prompt, use the ipconfig and ping tools to troubleshoot IP connectivity. For more information, see the following Microsoft Knowledge Base article:

   169790 How to troubleshoot basic TCP/IP problems.

2. At a command prompt, type nslookup www.msn.com to determine whether DNS is resolving Internet server names.

3. Make sure that Internet Options proxy settings reflect the appropriate proxy server if a proxy server is used in the local network.

4. If a Forefront Threat Management Gateway (TMG) firewall is installed on the boundary of the network, and the firewall requires client authentication, you may have to install a Forefront TMG Client program on the client device for Internet access. Contact your cloud service admin for help with this.

Resolution 2: Can't connect to AD FS

To resolve this issue, follow these steps:

1. Eliminate IP connectivity problems by using Resolution 1.

2. At the command prompt, type nslookup <AD FS 2.0 FQDN>, and then press Enter to determine whether DNS is resolving the AD FS service name correctly.
   
   Note In this command, <AD FS FQDN> represents the fully qualified domain name (FQDN) of the AD FS service name. It doesn't represent the Windows host name of the AD FS server.

   1. If the client is attached to the corporate network, make sure that the IP address that's resolved is a private IP address. The IP address should match one of the following patterns:

      • 10.x.x.x

      • 172.16.x.x

      • 192.168.x.x

   2. If the client is outside the corporate network, make sure that the IP address that's resolved is a public IP address. Make sure that it does not match one of the following patterns:

      • 10.x.x.x

      • 172.16.x.x

      • 192.168.x.x

   3. If the IP address that's resolved is incorrect based on step 1 and step 2, and other client computers don't experience the same behavior, do the following:

      1. At the command prompt, type ipconfig /all, and then check that the Primary DNS Server entry is appropriate for the network to which the client is attached.

      2. Open the %windir%\system32\drivers\etc\hosts file in Notepad, and then remove any entries for the AD FS FQDN. Then, save the file.

      3. At the command prompt, type ipconfig /flushdns to clear the DNS cache.

   Note If client devices are only attached to the corporate network, go to step 3.

3. Add the AD FS FQDN to the Proxy Bypass list. To do this, follow the steps in the following article in the Microsoft Knowledge Base:

   262981 Internet Explorer uses proxy server for local IP address even if the "Bypass Proxy Server for Local Addresses" option is turned on

Resolution 3: Certificate warning when you connect to the AD FS endpoint

To resolve this issue, troubleshoot Secure Sockets Layer (SSL) certificate issues by using the following article in the Microsoft Knowledge Base:

2523494 You receive a certificate warning from AD FS when you try to sign in to Office 365, Azure, or Intune

Resolution 4: You receive a single, unexpected credential prompt when you log on from a client computer that's connected to the corporate network

To resolve this issue, follow these steps:

1. Make sure that the client computer is successfully logged on to the domain.

   1. Click Start, click Run, type %logonserver%\sysvol, and then click OK.

   2. If a credential prompt appears, log off and then log back on by using corporate credentials.

2. Add the AD FS FQDN to the Local intranet zone.

   1. On the Security tab, click Local Intranet, and then click Sites.

   2. Click Advanced, and then examine the Websites listing for the fully qualified DNS name of the AD FS service endpoint (for example, sts.contoso.com).
      
      Note A wildcard value, such as "*.consoto.com" will also work in this configuration.

3. Add the AD FS FQDN to the Proxy Bypass list. To do this, follow the steps in the following article in the Microsoft Knowledge Base:
   

   262981 Internet Explorer uses proxy server for local IP address even if the "Bypass Proxy Server for Local Addresses" option is turned on

Resolution 5: Third-party web browser doesn't support Extended Protection for Authentication, and you receive looping authentication prompts

To resolve this issue, follow these steps:

1. Use Windows Internet Explorer (Internet Explorer supports Extended Protection for Authentication) instead of a third-party web browser that doesn't support Extended Protection for Authentication.

2. If using Internet Explorer isn't an option, use the following Microsoft Knowledge Base article to configure AD FS to accept requests from web browsers that do not support Extended Protection for Authentication:

   2461628 A federated user is repeatedly prompted for credentials during sign-in to Office 365, Azure, or Intune

Resolution 6: "Access Denied" error message when you try to connect to login.microsoftonline.com

Important This section contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in WindowsProblems may occur if the endpoint for Azure Active Directory SSO that's used by AD FS isn't valid. Make sure that the federation endpoint isn't hard-coded in the registry of each server in the AD FS Federation service farm.

To resolve this issue, use Registry Editor to delete the following registry subkey:

HKEY_LOCAL_MACHINE\Software\Microsoft\MOCHA\IdentityFederationAD FS will fall back to the correct endpoint based on the SSO Relying Party Trust.

Resolution 7: Reset disabled AD FS service endpoint setting to default configuration

For more information about how to do this, see the following Microsoft Knowledge Base article:

2712957 Sign in to Office 365, Azure, or Intune fails after you change the federation service endpoint 

Still need help? Go to Microsoft Community or the Azure Active Directory Forums website.