Skip to main content

Notifications

Announcements

No record found.

Microsoft Dynamics CRM (Archived)

CRM 2016 Outlook Client SSPI negotiation failed multiple domains

(0) ShareShare
ReportReport
Posted on by

Hi,
I am struggling to configure the Outlook client (Office 2010 x86, Windows 7) at my customer. They are using two domains to authenticate their users.
Domain A (rad.lan) Domain B (ocw.local) has a one-way trust configured between them. CRM is installed in the rad.lan domain and running under HTTPS (no IFD configured).
The web client works perfectly fine but I am unable to configure the Outlook Client which results in an SSPI negotiation failed error.

  • CRM 2016 SP1
  • HTTPS (443, no IFD)
  • Host header in DNS is a c-name and resolves correctly (same in IIS & deployment manager)
  • Correct date/time zones
  • Correct certificates

I have tried forcing credentials on my laptop (connected through VPN) using both credential manager and editing the configuration file (to use custom credentials instead of default Windows) but this also result in an access is denied error when searching for organizations.
Now the implementation guide states that users from another domain cannot configure the Outlook Client and that this is an unsupported scenario (without stating which is supported):

Users in a different domain cannot install Dynamics 365 for Outlook

If the user domain account is in a domain different from the Dynamics 365 organization, the user will receive an error message (see below) when installing Dynamics 365 for Outlook. This is not a supported scenario.
Error message:
There is a problem communicating with the Microsoft Dynamics 365 server. The server might be unavailable. Try again later. If the problem persists, contact your system administrator.
The caller was not authenticated by the service.

Can anyone clarify on this? Am I forced to implement IFD to make this situation work?
Kind regards,
Jeroen de Wit

*This post is locked for comments

  • Community Member Profile Picture
    Community Member Microsoft Employee on at
    RE: CRM 2016 Outlook Client SSPI negotiation failed multiple domains

    Hello. Tenfold can also help in integrating Microsoft Office 365 and Microsoft and enabling click to dial in Outlook. They also support MS Dynamics integration. Our click to dial also works on webpages opened in Chrome. www.tenfold.com/.../dynamics

  • Suggested answer
    Andreas Cieslik Profile Picture
    Andreas Cieslik 9,265 on at
    RE: CRM 2016 Outlook Client SSPI negotiation failed multiple domains

    Maybe this thread can guide you towards the right direction:

    community.dynamics.com/.../181986

    You could try to use ADFS server and setup IFD to work around this issue.

  • RE: CRM 2016 Outlook Client SSPI negotiation failed multiple domains

    This explanation seems very ambiguous to me. There is a one-way trust present between the domain that has the CRM installed (rad.lan) and the external domain (ocw.local). I'll have to check whether the OCW domain is in a different forest. If so a two-way trust is required if I understand this correctly?

    Nevertheless, trying to configure a rad.lan user results in "access is denied" exceptions from my device. I can see the user successfully log-on in the event viewer on the CRM front-end server and Fiddler doesn't give me much information what kind of request is sent which would case the access denied message....

  • Suggested answer
    Andreas Cieslik Profile Picture
    Andreas Cieslik 9,265 on at
    RE: CRM 2016 Outlook Client SSPI negotiation failed multiple domains

    Please check CRM's AD requirements:

    technet.microsoft.com/.../hh699704.aspx

    states:

    For users who access Microsoft Dynamics 365 from another domain and are not using claims-based authentication, a one-way trust must exist in which the domain where the Microsoft Dynamics 365 Server is located trusts the domain where the users are located.

    and:

    To add users to Microsoft Dynamics 365 that are not authenticated by using claims-based authentication, a two-way forest trust is required.

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

December Spotlight Star - Muhammad Affan

Congratulations to a top community star!

Top 10 leaders for November!

Congratulations to our November super stars!

Tips for Writing Effective Suggested Answers

Best practices for providing successful forum answers ✍️

Leaderboard

#1
André Arnaud de Calavon Profile Picture

André Arnaud de Cal... 291,280 Super User 2024 Season 2

#2
Martin Dráb Profile Picture

Martin Dráb 230,253 Most Valuable Professional

#3
nmaenpaa Profile Picture

nmaenpaa 101,156

Leaderboard

Featured topics

Product updates

Dynamics 365 release plans