Fix for SSO with Office 365 ProPlus (2016) and ADFS

If you are using an Office 365 ProPlus version prior to 1808, along with Windows 10 1703 or later, you may have an issue where Office applications do not use SSO to sign in, and after users enter their email address, they then have to enter their username and password again in the ADFS login form. Fortunately, there is a fix for this, which is listed in a Microsoft article but doesn’t specifically mention this issue.

Firstly, if you are running a Windows 10 build later than 1703, you will be using ADAL. So firstly, make sure you have this enabled in your ADFS infrastructure.

Enable ADAL Enable WS-Trust 1.3 for Desktop Client SSO ADAL

In your ADFS console, check the following endpoint shows enabled (/adfs/services/trust/13/windowstransport):

clip_image001

If not, run the following PowerShell command on your ADFS server to enable the endpoint for WS-Trust 1.3:

Enable-AdfsEndpoint -TargetAddressPath "/adfs/services/trust/13/windowstransport"

Apply the ADAL registry fix

Now you may find that SSO still does not work, and that users get a second username and password prompt, instead of SSO taking care of it. There is a fix listed at https://support.microsoft.com/en-us/help/4025962/can-t-sign-in-after-update-to-office-2016-build-16-0-7967-on-windows-1 Change Group Policy to add the following registry value at user login, or test using a reg file:

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity]
"DisableADALatopWAMOverride"=dword:00000001

Checking your Office 365 ProPlus version and features for Windows Desktop applications

How to check the version of your Office 365 desktop applications. If you have an Office 365 subscription, either home or business, you will probably be aware that your Office applications are updated from time to time.

Features are added, bugs are fixed, and performance is (hopefully) improved over time. So you may want to know what version you are running, and what the features are of that version.

Checking your Office 365 version

Firstly, you need to check which version of Office 365 you have installed.

  1. Open any Office application, such as Word or Excel, and create a new document.
  2. Choose File, then Account
  3. The version is shown below e.g. 1705

 

There are 2 ways to view the update history for Office 365 desktop, which will tell you which features were added in this version.

 

1  What’s new in Office 365

For Office 365 Subscribers:

https://support.office.com/en-us/article/what-s-new-in-office-365-95c8d81d-08ba-42c1-914f-bca4603e1426?ui=en-US&rs=en-US&ad=US

Or if you are an Office 365 Insider:

https://support.office.com/en-us/article/what-s-new-for-office-insiders-c152d1e2-96ff-4ce9-8c14-e74e13847a24?ui=en-US&rs=en-US&ad=US

These pages give a high level overview of the features added in the various releases. If you scroll down you can see features added in previous releases.

 

2  Update history for Office Insider for Windows desktop

This gives a more detailed list of changes

https://support.office.com/en-us/article/update-history-for-office-insider-for-windows-desktop-64bbb317-972a-4933-8b82-cc866f0b067c

For more information see :

When do I get the newest features in Office 2016 for Office 365?

https://support.office.com/en-us/article/when-do-i-get-the-newest-features-in-office-2016-for-office-365-da36192c-58b9-4bc9-8d51-bb6eed468516?ui=en-US&rs=en-US&ad=US

Also see https://docs.microsoft.com/en-gb/officeupdates/release-notes-office365-proplus to see which version you get depending on your update channel.