The best possible solution in this case would be to add the public address which represent your RDS farm in Trusted IPs on MFA portal so that you don't get MFA prompt on your corp network. Which is why users are getting prompted for authentication when they login to any other server in the farm. For security reasons, Refresh token is bound to application and device and can not be used on any other device. Now, at the expiry of the Access token, Refresh token is redeemed to get new access token and when refresh token is redeemed, no user interaction is required and no MFA prompt occurs. Access token is short lived (1 hr by default) and Refresh token is for 90 days by default. Welcome to Q&A Platform and thanks for your query.Īfter successful authentication, regardless of whether it is single factor or multi factor, Access Token and Refresh Token pair is issued to the user.office-outlook-itpro windows-server-2016 azure-ad-multi-factor-authentication What I am asking is there a way to write-back their credentials, so if they authenticate correctly against Outlook in one of the RDS servers, they do not need to re-enter their credentials for the remaining RDS servers in the farm. The issue is when this user logs out, then back into a different RDS server, for example RDS5, when they launch Outlook they need to re-enter their password and their MFA response. Once this is entered, Outlook connects and works fine. When a user logs into RDS1, for example, then opens Outlook after MFA is enabled, they get prompted for their password, then the MFA response.

In our scenario, we have an RDS farm, with servers RDS1-10. Just to be clear, I am not trying to use MFA to log into the RDS servers, just for the Office 365 apps. The MFA itself is working fine and there is no Azure AD Sync, so the local AD accounts are completely separate from the Office 365 accounts. The issue starts happening after MFA is enabled in Office 365 for a particular user. I have enabled MFA in Office 365, now when a user opens Outlook 2016 on an RDS server, they need to re-enter their credentials when they connect to a new server.

Office 365 mail server for outlook 2016