You are repeatedly prompted for credentials when you start Outlook 2007 that has a mailbox hosted by Exchange Online on a computer that is behind an ISA Server 2006 or ISA Server 2004 firewall

Consider the following scenario:

• You use a computer that is behind a Microsoft Internet Security and Acceleration (ISA) Server 2006 firewall or an ISA Server 2004 firewall.
• The ISA Server-based computer has a Web listener that is pointed to https://widgets.microsoft.com.
• The ISA Server-based computer requires all requests to be authenticated.

In this scenario, you can sign in to the single sign-on (SSO) client and access all functions successfully. However, when you start Outlook 2007 that has a mailbox hosted by Exchange Online, you are repeatedly prompted for credentials.

This issue occurs because the ISA server has a Web listener and is listening for requests on https://widgets.microsoft.com. The Web listener requires all requests to be authenticated. All requests are redirected to an ISA forms-based authentication page. Or, integrated credentials are accepted if the client passes them. Outlook clearly passes integrated credentials. However, those credentials are for Microsoft Online, not for the local Active Directory. Therefore, the credentials are denied, and you are prompted for credentials again.

To resolve this issue, create an ISA publishing rule that has the following criteria:

• Type: Deny rule
• Path: /autodiscover/autodiscover.xml
• Users:� All Users

This new publishing rule means that the server should deny any request that comes in for the following path: � Note You have to put this rule at the top of the other Web publishing rules to make sure that the request does not go through.