During a migration from Exchange onPrem to Microsoft 365, the error occurred that users synchronized via AADConnect could not log in to some services (such as Exchange Online and Office Portal) (HTTP 500 error). However, it was possible to log in to Teams and OneDrive without any problems. It was also possible to log in to all services via Edge and Internet Explorer, but not from smartphones and other browsers such as Chrome, Firefox or Safari. Signing in with Outlook was also possible without any problems.
When I tried to log on to the Office Portal (https://portal.office.com), only the following error message was displayed (unfortunately not very helpful):
Sorry, that didn't work.The HTTP 500 error message when trying to log in to Outlook Web (https://outlook.office.com) was a little more helpful here:
The following section from the details of the error message is of interest here:
X-Auth-Error OpenIdConnect Microsoft.Exchange.Security.OpenIdConnect.OpenIdConnecIdpExceptionThe text "OpenIdConnectIdpException" indicates that there are problems with AADConnect and the type of user login. In this specific case, AADConnect was configured to the "Passthrough authentication" login method (default). However, pass-through authentication was deactivated in the Azure Active Directory and no agent was installed in the onPrem environment:
Since in this case the hybrid configuration only existed until the migration was completed, the "Password hash synchronization" login method was activated in AADConnect:
After synchronization, it was possible to log in with all devices and browsers without any problems. Alternatively, the corresponding agent can also be installed so that pass-through authentication can be used accordingly. Further information on pass-through authentication and password hash synchronization can be found here:
- https://docs.microsoft.com/de-de/azure/active-directory/hybrid/how-to-connect-pta
- https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs
Süpertrtt