Fixed it. With more persistence testing so many different scenarios, I've narrowed it down to:
Solution 1 Scenario: New Profile or start from scratch (delete old user profile)
1. Before starting Outlook to add any accounts, add the following registry entries:
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity]
"DisableADALatopWAMOverride"=dword:00000001
[Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Autodiscover]
"ExcludeExplicitO365Endpoint"=dword:00000001
"ExcludeHttpsRootDomain"=dword:00000001
2. Then add the email accounts as usual.
Note: I've also noticed with "DisableADALatopWAMOverride", I didn't see any "Allow Organization manage this device" or something similar - but it works!
Solution 2 Scenario: Existing User Profile (too many reasons not to delete existing user profile)
I managed to save more time by not recreating the users profile as I had three others experiencing this issue with large profile data by keeping the current users environment intact by doing this:
1. Add the following registry entry on current device and profile:
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity]
"DisableADALatopWAMOverride"=dword:00000001
[Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Autodiscover]
"ExcludeExplicitO365Endpoint"=dword:00000001
"ExcludeHttpsRootDomain"=dword:00000001
2. In Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity\Identities, delete all identities that correspond to the email address and not the @domain.local_AD
3. In Credentials Manager > Windows Credentials, delete all the Generic Credentials relating to Office16.....
4. Start Outlook and enter your password. Then close.
5. Log out of existing profile.
6. Then on the same device, create a new fresh new user profile by logging in with a new user account that has never logged in to that device before and add the following registry entry:
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity]
"DisableADALatopWAMOverride"=dword:00000001
Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Autodiscover
"ExcludeExplicitO365Endpoint"=dword:00000001
"ExcludeHttpsRootDomain"=dword:00000001
7. Then add the email accounts as usual. Go back to your existing profile and don't log out of the new profile and sign in as a different user and sign in as the existing user.
8. Start Outlook and magically, this fixes the password prompt.
With so many logouts and logging back in since applying these fix, cross fingers the issue of Outlook asking for password everytime it start hasn't come back.
To apply the fix on the next user you provision, you can also add this to your GPO User Configuration > Preference > Windows Settings > Registry so that a new user/profile created will apply this fix prior to creating the new Outlook profile and email account.
Hope this helps someone.
ArielSE
