Microsoft Outlook for Android Issues ("Please sign in to .... again")

Something appears to have broken recently when utilizing multiple Microsoft applications on Android along with the Microsoft Authenticator app. The authenticator app is attempting to perform SSO functions between Microsoft Apps. When you switch to a third party mail application, it eliminates the ability for Authenticator to perform SSO and authentication brokering for mail, and the conflict no longer exists.

So far, the fix appears to be:

A) Remove Microsoft Authenticator. Utilize OTP codes, SMS messages, Phone Calls, or Email for MFA if needed.

OR

B) Remove additional Microsoft applications. The issue occurs only when multiple Microsoft applications are used. Authenticator attempts to share the log on session between all Microsoft apps, and when Outlook, Teams, Office applications, etc on Android go to refresh their access token, they balk.

OR

C) Register your device with your organizations Azure AD. Do this from the Settings > Device Registration item in the Microsoft Authenticator app.

The issue never occurred previously, despite running multiple applications for months. A recent update to Microsoft applications on Android started the issue, though I'm not sure at this point if the issue is with Authenitcator itself or if the other Microsoft apps need updates to work better with Authenticator. Outlook has been updated several times since Authenticator, but other apps like Teams are still behind. Hopefully some app updates come out soon that make these work seamlessly again.

This info is far more helpful than anything I've seen/heard from MSFT so far.  

Interestingly, I did install Excel / PowerPoint on my phone.  (I have a Note9 and used it drive a PPT deck in a meeting, worked well)

I don't recall if that is when all of this started, but could be possible.

Teams and Outlook seem to be the worst, but I have triggered this with OneNote. Azure AD shows the pattern for "Microsoft Office" applications in addition to Outlook and Teams. 

So what I imagine is when you open Excel/Powerpoint, "Office" on your mobile will generate an access token with your credentials that is good for an hour, and a refresh token. Refresh tokens are good, typically, for 90 days, and their lifetime extends every time a new access token is generated. Your app will send the refresh token to Azure when the hour is up to get a new access token. 

My theory is something about the "shared" refresh token isn't liked across applications. So, the next time Outlook hits its hour window, and an Office application has last modified the refresh token, it asks for sign in again.

At that point, if you never sign back into Excel or Powerpoint, nothing else modifies the refresh token and you can continue on without ever getting another sign in request. The office suite and Teams don't request for sign in with a notification like Outlook does, so the problem isn't noticeable from that perspective. But if you're to turn around, open one of the office apps and either manually sign in or encounter that flashing "pick account" dialog which is generating a sign on event in Azure AD, your Outlook will request login within an hour or two. 

I think Authenticator is successfully brokering the connection for all the apps but the applications aren't updated yet to understand the data being returned by the app. They get an unexpected response and therefore believe they need to sign in again.

Again, if you're not using Authenticator, all the applications generate their own access and refresh tokens that never interact so the token thrashing never becomes an issue.

I'm not 100% sure that is my issue, the more I think about it.

1 - I haven't used Excel / PowerPoint since April  (maybe something is open in background?)

2 - Android is able to get new messages since it actually shows them on the notification screen, but they don't show up in Outlook app 

I wonder if the background notification mail check/preview code works differently than regular outlook?  

On the other hand, I installed AquaMail and it hasn't complained once.  Since that is a non-MS product, I'm guessing it wouldn't be sharing with the other MS stuff which could support your thought.

Not sure.