Problem - Exchange 2019 CU15 & Modern Auth through on-prem ADFS

Romain 0 Reputation points
2025-08-05T05:27:36.2966667+00:00

Hi,

I am trying to configure Modern Auth with my up-to-date Exchange 2019 CU15 DAG.  Please note that I want to authenticate through my on-prem ADFS and not Office 365.  Outlook version is Microsoft® Outlook® for Microsoft 365 MSO (Version 2506 Build 16.0.18925.20076) 64-bit. 

I followed this tutorial: https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/enable-modern-auth-in-exchange-server-on-premises#how-will-modern-authentication-work-and-is-this-feature-applicable-to-me  However, I am unable to get Outlook client to work with it.

More info:  On client side, I added the few registry keys in the tutorial + others I found during my research: 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\office\16.0\outlook\autodiscover  DWORD: ExcludeExplicitO365Endpoit

HKEY_CURRENT_USER\Software\Microsoft\Exchange\  DWORD: AlwaysUseMSOAuthForAutoDiscover 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Common\Identity\  DWORD: EnableADAL 

 

When I launch Outlook, the ADFS authentication window appears as expected.  I enter my credentials, but then it spins indefinitely.  If I add my account to a new profile, the same thing happens, except that I end up with error 62ubh (An error occurred).

 Looking at the ADFS side, authentication works fine. There is no error log about it.  If I run Fiddler on my computer, I can see that ADFS is sending me a valid token. 

My Outlook calls https://adfs.myfakedomain.com/adfs/oauth2/authorize then https://adfs.myfakedomain.com/adfs/oauth2/token, but once the token is received, a new URL is called and ends with 404 error:  https://adfs.myfakedomain.com/common/sso/progress?stage=Closing 

I can't debug any further and understand what's happening.  I don't know if it's the return URL sent by ADFS that's incorrect, or if it's my Outlook that doesn't understand the response from my ADFS and wants to close the SSO session.  I don't understand why it doesn't move on to step 7 of the process (schema on the howto from Microsoft).   

Based on my understanding, Outlook should now contact my Exchanges with the newly received tokens, right? 

I would therefore appreciate your help in clarifying this for me.

Exchange | Exchange Server | Other
Exchange | Exchange Server | Other

A robust email, calendaring, and collaboration platform developed by Microsoft, designed for enterprise-level communication and data management.Miscellaneous topics that do not fit into specific categories.

0 comments

7 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Dexpi 5 Reputation points
    2025-09-02T10:29:17.6233333+00:00

    Hello,

    I’ve already tried the fix suggested by Jo and Jerry. My certificate is issued by GoDaddy. I tested the CRL URL directly on the PC and it is accessible without any issue. I also added the CRL and AIA certificates on all relevant servers using certutil (PC, ADFS, WAP, and Exchange 2019). Unfortunately, the problem is still persisting.

    Even adding EnableExchangeOnPremModernAuth key doesn't fix the issue.

    Btw, someone tried to deploy Modern Auth with WAP? WAP doesn't even read and forward the request on the ADFS...

    Do you have any ideas?

    Was this answer helpful?

  2. Abdelrhman Ali 1 Reputation point Microsoft External Staff
    2026-08-19T18:10:50.2933333+00:00

    Hello,

    The issue was related to the EnableExchangeOnPremModernAuth registry key. We noticed that the manually configured registry settings were not being applied to Outlook as expected (blocked related to Antivirus/EDR/Endpoint).

    • To ensure the required registry configuration was consistently applied through a trusted Windows process, we used a Group Policy (GPO) approach:
    • User Configuration → Preferences → Windows Settings → Registry
    • We added the EnableExchangeOnPremModernAuth REG_DWORD with value 1 under: SOFTWARE\Microsoft\Office\16.0\Common\Identity

    After running gpUpdate /force and restarting Outlook, we successfully confirmed that authentication was being performed using OAuth (Bearer Authentication).

    https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/enable-modern-auth-in-exchange-server-on-premises#microsoft-windows

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.