Outlook Keeps Asking For Credentials (Username and Password)

A very common problem is when Outlook  starts asking for the user credentials, even if the correct password is specified. It looks like this: after starting Outlook successfully connects to the on-premises Exchange server (or Office 365 mailbox), the user sees a list of folders in the mailbox and new emails in the Inbox. But after a few minutes of normal work, a window appears for entering the user name and password. The user enters the password and presses OK, but the window with the prompt to enter the credentials appears again. By clicking the “Cancel” button, the user can continue to work with Outlook, but after a while the window asking for the password pops up again (sometimes the user account may be locked at the same time).  The problem occurs in different versions of Outlook (2019/2016/365) and Windows (there was a problem in both Windows 7/8.1 and Windows 10).

Most admins in this case try to recreate the mail profile, reinstall Office – but this usually does not help. Outlook with some periodicity still requires the user to enter a password.

Consider several ways that can help you to remove the annoying password request window in Outlook.

Clear Saved Outlook Credentials

Check if you have Outlook saved passwords stored in the Windows Password Manager (Credential Manager), try to delete them all. To do this, go to Control Panel\All Control Panel Items\User Accounts\Manage your credential -> Windows Credentials. Find the saved passwords for Outlook/Office in the Generic Credentials list and remove them.

To directly access Credential Manager, run the command:

rundll32.exe keymgr.dll,KRShowKeyMgr

Disable “Always Prompt for Credentials” Option in Outlook

Open your Outlook Account Settings (File -> Account Settings -> Account Settings), double click on your Exchange account. Go to More settings -> select Security tab. Clear the checkbox Always prompt for credentials in the User identification section.

If you have an Office 365 mailbox connected, this tab should have an additional “Logon network security” field. Make sure that “Anonymous Authentication” is not selected.

Outlook Anywhere and NTLM authentication

If your Outlook is configured to access the Exchange mailbox using Outlook Anywhere (MAPI over HTTP), verify that NTLM authentication is used. At the same time, you need to check the authentication type used for the IIS site on the Exchange server.
If the computer with a problem Outlook is not joined to the Active Directory domain, then on the contrary, you should try to switc from NTLM authentication to Basic.

Outlook: Disable Office 365 Autodiscover

Somewhere in the fall of 2016, an update was released for Outlook 2016 that enabled a mandatory check of the Office 365 cloud connection point. You can verify this by using the Fiddler or TCPView tools and track the attempts to connect to the autodiscover-s.outlook.com and outlook.office365.com servers.

To disable this check, go to the registry key HKEY_CURRENT_USER\Software \Microsoft\Office\16.0\Outlook\AutoDiscover and create new DWORD parameter named ExcludeExplicitO365Endpoint and value 1. Restart Outlook.

The ExcludeExplicitO365Endpoint registry parameter is applicable to Outlook 2016 version 16.0.6741.2017 and newer (this parameter is additional to the list of parameters that determine the types of Autodiscover processes when Outlook starts:

You can make changes to the registry with the following command:

reg add HKEY_CURRENT_USER\Software\Microsoft\Office\x.0\Outlook\AutoDiscover /t REG_DWORD /v ExcludeExplicitO365Endpoint /d 1
Or, using the PowerShell cmdlet Set-ItemProperty:
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\AutoDiscover" -Name 'ExcludeExplicitO365Endpoint' -Value 1 -Type DWORD –Force

Change Office 365 User Authentication Method

If your mailbox has been migrated from on-premises Exchange to Office 365 or you have two mailboxes connected in Outlook (one from the on-premises Exchange, the second from Office 365) and you use an RPC connection, in this case Outlook doesn’t use Modern Authentication (also used for MFA). In this case, your credentials are sent to Office 356 instead of token. To force Outlook to use Modern Authentication for RPC connections, you need to add the AlwaysUseMSOAuthForAutoDiscover DWORD parameter with the value 1 to the registry key HKCU\Software\Microsoft\Exchange.

Set-ItemProperty -Path " HKCU:\Software\Microsoft\Exchange" -Name 'AlwaysUseMSOAuthForAutoDiscover' -Value 1 -Type DWORD -Force

Ensure that a Modern Authentication is enabled for your Office 365 account in the Office 365 Admin Center (Settings -> Services & add-ins).

If on the contrary you want to completely disable Modern Authentication in Outlook 2016/2019/365 (this authentication method should be disabled in the Admin Center), you need to configure the following registry settings:

Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Identity" -Name EnableAdal -Value 0 -Type DWORD –Force
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Identity" -Name DisableADALatopWAMOverride -Value 1 -Type DWORD –Force
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Identity" -Name DisableAADWAM -Value 1 -Type DWORD –Force

Recreate Your Outlook Profile

If all of these methods above did not help you get rid of the problem, try to delete and recreate your Outlook profile. You can create a new Outlook profile using the Mail icon in the Control Panel or using the outlook.exe /manageprofiles command.

Temporary Disable Your Anti-virus and Firewall Protection

Perhaps the Exchange connection problem is caused by your anti-virus or firewall software. Try to temporarily disable it and check whether Outlook continues to prompts a password.

Poor Network Connection to Exchange Server

A poor and unstable network connection to the Exchange server and/or domain controller can also be a source of periodic password requests in Outlook. You can test the network performance using the iperf tool.

Also check the computer time, it should differ from the time on the domain controller for no more than 5 minutes. If more, check the NTP time synchronization scheme in your domain.