The first step after MFA is enabled for a user, is for the user to log into O365 via the portal.  Through that process they'll receive an app password that they'll need to use to sign into the Outlook and Skype clients.  This same app password is used for the credentials on a mobile device native email app.

Office 2016 is already Modern Authentication aware so APP passwords are not required. Native IOS and Android Mail apps will require the APP password or users can use Outlook for IOS/Android which is Modern Auth aware. FYI outlook 2013 requires a registry setting to work with MA.

In this case are you saying that there is a password prompt for the users credentials? If so we usually try one of two things. Clear the Windows Credential manager or recreate the users Outlook profile. In fact if you just turned on MFA and you were not using MFA before you usually end up having to rebuild the profile and clearing the credential manager. If you are saying that they are getting multiple MFA prompts then this is an out of sync issue with the wrong code being used. 

We are looking at using conditional access policies where a user with a Domain joined PC is not prompted for MFA. Right now we have it set to prompt when a user is not on any of our corporate networks or they are using a mobile device. 

You don't say what OS you are using, but in windows 10 (maybe Pro or higher?) I can go to Windows Settings > Accounts > Access work or school and add an O365 admin account there. This will allow your O365 to use the windows user credentials to connect to Office365.  IMO this is not exactly a secure configuration, but it should eliminate the multiple popups.

You could also disable MFA on the regular user's account, and create an admin account (with MFA) that is separate from your regular user account.

Thanks, trying not to sound like I'm being Debbie Downer, but... :-)

• We can't turn off MFA for users as it is a policy requirement. Even if temporary disabled it has to go through a higher approval process.
  
• We can't rebuild the Outlook profile when this occurs as our users have fairly large mailboxes so don't want to do this each time.
• We currently have a mixture of Win8.1 and Win10 desktops so adding the O365 account to Windows is not an option (on Win8.1).

In the instances that this occurs the effected user is not new to MFA but has been running it for at least months. The problem appears to randomly affect users (I've had it affect myself once too), and the only solution appears to one of (or a combination of) the options in the OP. The modern auth prompt happily accepts the password and moves on to the MFA stage so the password has been accepted as correct, the MFA auth (ie SMS) is then generated and the user types in the code to the prompt, clicks OK, it thinks for a second or two and then prompts the user for the password again. Out of 140 staff the problem seems to occur once every 2-3 weeks on average.

It's not caused by an out of sync MFA prompt as I have personally looked at a number of cases with the user as stepped through it.

Cheers
Adam

We have been experiencing the exact same issue for months now. I experience the issue myself as well, every once in a while.

Since I'm one of the guinea pigs in the 'targeted release', I get new versions sooner than our general population (mostly to figure out what new "features" to block through GPO).

Today was the first time in about 2 months that I had the issue. It happened right before lunch, locked my machine, went out for lunch, came back, and logged in, this time successfully. So not doing anything at all even seems to work. Which to me sounds like the issue is service side, not client side.

Thoughts?

Yeap, you describe it exactly and unfortunately we still don't have an answer. Sometimes the problem just goes away after 10mins and sometimes (witnessed this last week myself) after the looping back through the password prompt a 3rd time we just closed the modern auth window without entering the password again and Outlook suddenly showed 'Connected to Exchange', it then updated with new email and then dropped back to 'Needs Password' and the modern auth window appeared again. Closed the window without entering anything and Outlook returned to 'Connected to Exchange'. 

We've got a support case opened with Microsoft on this one but it's been open for about 3 months. Unfortunately when the problem occurs they've asked us to ring straight away but of course you can never get them instantly (we've just been given someone's direct number now). To make a long story short we've since been asked to collect Outlook logs and install Fiddler to capture additional logging. But we're not going to deploy Fiddler to all users PC's or leave it continually logging so the problem comes back to trying to capture an issue that randomly occurs, on a PC with Fiddler already installed, and getting the recording started in time before the problem disappears.

Problem doesn't just happen on PC's connected to the internal network, but can happen when a laptop is remote and connected via external wifi or mobile hotspot.

I'll let you know how we go.

Cheers
Adam

Hey guys, we are having the same issue here. We just implemented Azure MFA about a month ago and one of our user's computers, of course the CEO, has started exhibiting this behavior. Outlook keeps asking for password > MFA texts him a code > he enters code in Outlook > Outlook asks for password again. If you cancel out of this process, Outlook goes into "Need password" and no email is received.

Windows 10, Office 2016 (click to run version from our O365 portal). They are pretty up to date on everything, so they should have all of the latest updates installed.

What worked for me is pretty strange. I created a new Outlook profile, and then the old one started working. I wonder if the compuer cached a new logon token or something that the old Outlook profile could use. Also, during the new profile creation, I was only prompted for a password and not for MFA. When we opened the old, existing profile it didn't ask for ANY authentication, it just started working.

Please keep us updated on your case, I'd be very interested in hearing the result. You're doing God's work hanging in there 3 months, that's for sure. I know how that can be!

Thanks,

Cory

We too have been seeing this more and more, all W10 on O365, although we use Okta as our MFA. I feel like this issue is getting progressively worse as the fix used to be clearing the credential manager or if it was bad uninstalling the entire Office Suite, clearing all traces and reinstalling and now we are seeing nothing helping it. Have looked all over and people have all sorts of possible solutions, but nothing we found to resolve the issue and get a new issue daily and just keep going through until it eventually works. 

Also experiencing this issue with our W10 clients and have had a ticket open with Microsoft for several weeks to no avail. We've had varying levels of success with all the workarounds mentioned here: clearing cred manager, re-launching Outlook on the client machine, etc. 

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
DisableADALatopWAMOverride
dword value 1

After that, modern auth was working again.

MikeCMFA wrote:

We were having the same issue on Windows 10 V 1703 and MS gave us a regedit that seemed to fix the issue (for us, on Windows 10 V 1703).  Add the following:

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
DisableADALatopWAMOverride
dword value 1

After that, modern auth was working again.

This worked for me so I vote this as the answer B-)

Make that the following command:

REG add HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity /v DisableADALatopWAMOverride /t reg_dword /d 1 /f

Use the following key in Command Prompt (Administrator Mode):

REG add HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity /v DisableADALatopWAMOverride /t reg_dword /d 1 /f

@RobC0619's suggestions helped me.

What did NOT work:

•  Reg Edits - did not provide a work around
  
• Creating a new Outlook Profile through Control Panel > Mail - Did NOT work in isolation. I had to combine it with several other steps
• Deleting all affiliated credentials from Credential Management (through Control Panel) - Again, did NOT work in isolation.

What DID Work (cover all of the bases), do the following:

1. Create Back-ups
   • Image/backup of system/files to your liking
   • Delete any RegEdits made from previous failed workarounds
   • Back-up Registry 
   • Back-up Outlook files
2. Outlook 365 > Accounts -->Sign-out/remove all accounts (I wasn't sure if my personal Microsoft Live account was a part of the issue, so I removed that too)
3. Settings > Accounts > Email & app Accounts --> Click Manage
   
4. Settings > Accounts > Access Work or School --> Disconnect the work/school account
5. Control Panel > Mail > Profiles --> Delete all Profiles (basically in attempt to wipe out all existing logged credentials and files that could be causing conflicts)
6. Control Panel > Credential Manager > Windows Credentials --> Delete all credentials associated with 365 suite (I deleted all related credentials for both my work/school and again, my personal account for good measure) I also deleted credentials that were associated with both my work/school OneDrive and my personal OneDrive programs.
7. Restart (for good measure)
8. Attempt fresh sign-in to work/school account (do this FIRST, before attempting to sign-in with personal account)
   1. Test connectivity - 365 was able to sign-in for all of the office suite at this point.
9. If sign-in was successful (it was for me at this point), go ahead and do the same for you work/school OneDrive and finally re-add your personal account to Outlook/Office 365.

A couple of notes: It is clear the issue was not the 2-step authentication. This was working just fine when attempting to login via Outlook.com web portal and what not. If I had to guess, Going to Manage --> Sign-out of all devices was probably an important step.

You may have to rebuild/restore your outlook folder/files which is a pain. I'd do that one step at a time, forgoing the restore of the cached files. Just go with your address book and things.

@Microsoft, given the level of attention the community has given this issue, I hope you come up with an update soon. 

Cheers everyone.

RobC0619 wrote:

Office 2016 is already Modern Authentication aware so APP passwords are not required. Native IOS and Android Mail apps will require the APP password or users can use Outlook for IOS/Android which is Modern Auth aware. FYI outlook 2013 requires a registry setting to work with MA.

In this case are you saying that there is a password prompt for the users credentials? If so we usually try one of two things. Clear the Windows Credential manager or recreate the users Outlook profile. In fact if you just turned on MFA and you were not using MFA before you usually end up having to rebuild the profile and clearing the credential manager. If you are saying that they are getting multiple MFA prompts then this is an out of sync issue with the wrong code being used. 

We are looking at using conditional access policies where a user with a Domain joined PC is not prompted for MFA. Right now we have it set to prompt when a user is not on any of our corporate networks or they are using a mobile device. 

My client's Outlook will only continuously ask for the password after MFA is enforced and Office.com has been logged in. It would be nice if it distinguished between your password and the app password.

We had the issue where Outlook 2016 kept prompting for a password for an Office 365 user whose laptop was connected to their Office 365 account using Windows 10 Pro. The repeated issue logging in started after I enabled the modern authentication in the Office 365 administration panel. The user could use the Windows mail and calendar apps but Outlook wouldn't connect and kept prompting for a password. Checking the Account in Word showed the correct authentication and subscription. Also, at the time, that user did not have MFA turned on.

The solution, as clued in by ncazer and others, was to delete the Windows Credentials:

"6. Control Panel > Credential Manager > Windows Credentials --> Delete all credentials associated with 365 suite (I deleted all related credentials for both my work/school and again, my personal account for good measure) I also deleted credentials that were associated with both my work/school OneDrive and my personal OneDrive programs."

The user had Office 2015 and Office 2016 credentials and Teams credentials that we deleted. We checked with Word that the account was connected--it was and the we opened Outlook and it immediately connected.

This is an old post, but the first result in Google, so I wanted to chime in with the fix that worked for me that wasn't listed above:  Disabling Outlook plugins.

My Outlook was working fine in between the password prompts every few seconds, the app password I put in was working for all my other Office apps, but if I cancelled the prompt, the status bar changed to "Needs Password" and Outlook would stop updating for me.  

I disabled the Zoom and Adobe PDF plugins and it stopped prompting me immediately.

I've seen this happen when the time and or date is wrong on the machine.

it could be the Office 365 organisation flag OAuth2ClientProfileEnabled - in older installs this was set to false - it needs to be set to true now

in elevated powershell...

                        1. Install-Module PowerShellGet -Force 
                        2. Set-ExecutionPolicy Unrestricted <After this step, please reopen the window.> 
                        3. Install-Module -Name ExchangeOnlineManagement 

connect as an admin with           Connect-ExchangeOnline 

check settings               get-organizationconfig

and set with                  Set-OrganizationConfig -OAuth2ClientProfileEnabled $true