Option 3 seems most likely, but also time-consuming and reliant on MS to make it happen.A few weeks back, my colleague Brian Podolsky wrote a blog post article detailing the deprecation of legacy authentication in favor of modern authentication for Exchange Online. Option 2 is possibly not technically feasible (doesn't seem to be a way to identify Mac Office via UserAgent or something when looking at Wireshark captures). None of these are particularly appetizing option 1 is very user impactful and tricky to manage with password changes/token expirations. Gripe to Microsoft to make Mac Office properly handle a rejected Kerberos ticket and failback to username/password. Try to make the authentication server recognize when a Mac Office app is authenticating, and offer NTLM, forms-based or plain text authentication instead of Kerberosģ.

Then start EC again to get a new Kerberos ticket for ongoing operations (server auth, etc.).Ģ. Close out of EC and trash any existing Kerberos tickets from DOMAINA.COM before signing in to Outlook/Skype for the first time (or after password change, or authentication token expiration, most likely). As our tenant requires Modern Authentication, we have a few options:ġ. The users however have to authenticate against DOMAINB.COM which doesn't trust DOMAINA.COM. In our situation, we have Apple Enterprise Connect pulling Kerberos tickets from our primary domain/Kerberos realm DOMAINA.COM. We also ran into this due to our O365 tenant-to-tenant migration. Did you try defaults write DisableModernAuth -bool YES ?

Disable modern authentication