Outlook Not Connecting to Exchange Online After Tenant Migration

Overview

After migrating mailboxes from one Microsoft 365 tenant to another, Outlook desktop clients often fail to reconnect. The user sees "Disconnected", "Trying to connect...", or is prompted repeatedly for credentials that do not work.

This happens because Outlook caches the old tenant's Autodiscover endpoint and authentication tokens. The fix involves clearing those caches and forcing Outlook to rediscover the new mailbox location.

Quick Fix Checklist

Work through these steps in order. Most cases are resolved by step 3.

1. Close Outlook completely

Make sure Outlook is fully closed — check the system tray and Task Manager for OUTLOOK.EXE.

2. Clear cached credentials

Old credentials pointing to the previous tenant must be removed.

1. Open Control Panel > Credential Manager (or search "Credential Manager" in Start)
2. Select Windows Credentials
3. Find and remove all entries containing:
   • MicrosoftOffice16_Data:SSPI:[email protected]
   • outlook.office365.com
   • login.microsoftonline.com
   • Any entries referencing the old tenant domain
4. Also check Generic Credentials for the same entries

cmdkey /list | findstr "outlook.office365.com"
cmdkey /delete:outlook.office365.com

3. Delete the Outlook profile and create a new one

This is the most reliable fix. A new profile forces a clean Autodiscover lookup against the new tenant.

1. Open Control Panel > Mail (Microsoft Outlook)
2. Click Show Profiles
3. Click Add and create a new profile with the user's email address
4. Set the new profile as default
5. Open Outlook — it will auto-discover the new tenant

4. Clear the Autodiscover cache

If you cannot recreate the profile (for example, the user has local PST files attached), clear the Autodiscover cache manually.

Delete this registry key:

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover

Or via PowerShell:

Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\AutoDiscover" -Recurse -ErrorAction SilentlyContinue

Then restart Outlook.

5. Verify DNS — Autodiscover CNAME

The most common root cause of persistent issues is that the DNS Autodiscover CNAME record still points to the old tenant.

Verify the record:

Resolve-DnsName -Name "autodiscover.yourdomain.com" -Type CNAME

The expected result should point to:

autodiscover.outlook.com

If it points to a tenant-specific endpoint like autodiscover.yourdomain.mail.onmicrosoft.com, update it to the generic endpoint above.

6. Check the Outlook connection status

If Outlook opens but shows "Disconnected" or "Need Password":

1. Hold Ctrl and right-click the Outlook icon in the system tray
2. Select Connection Status
3. Check which server Outlook is trying to connect to

If the server name references the old tenant (outlook.office365.com is correct; a tenant-specific URL is not), repeat steps 2-4.

Advanced Troubleshooting

Test Autodiscover manually

Use the built-in Outlook Autodiscover test:

1. Hold Ctrl, right-click the Outlook tray icon
2. Select Test E-mail AutoConfiguration
3. Enter the user's email and password
4. Uncheck Use Guessmart and Secure Guessmart Authentication
5. Check only Use AutoDiscover
6. Click Test

The results should show the Exchange server URL pointing to outlook.office365.com.

Check for Autodiscover registry overrides

Some organisations set Autodiscover overrides in the registry that bypass DNS:

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover

Look for values like ExcludeExplicitO365Endpoint or hard-coded redirect URLs. Remove any stale overrides.

Modern Auth (OAuth)

As of October 2022, Microsoft has permanently disabled Basic Authentication for Exchange Online. All connections must use Modern Authentication (OAuth). This is no longer optional and cannot be re-enabled.

• Outlook 2016 (with current updates) and Outlook 2019/2021/Microsoft 365 support Modern Auth natively — no configuration needed
• Outlook 2013 reached end of life in April 2023 and should not be used. It does not reliably support Modern Auth

If users are running Outlook 2013, they must upgrade to a supported version.

When to Escalate

Escalate via the Microsoft 365 admin center (admin.microsoft.com > Support > New service request) or Microsoft Support if:

• Autodiscover returns the correct URL but Outlook still cannot authenticate
• The mailbox migration shows as complete in the admin centre but Outlook reports "mailbox not found"
• The user is on a hybrid (on-premises + cloud) configuration and connectivity broke post-migration
• Certificate errors appear during Autodiscover negotiation

Summary

In most cases, clearing credentials and creating a new profile resolves the issue within 5 minutes. If it persists, the problem is almost always DNS.