I don’t have screenshots of this, but I figured it is worth writing up because we couldn’t find any reference to this scenario. Hopefully it will help others.
The Problem
- We had an Office 365 portal for a while for Exchange Online Protection and a few other things.
- As a global admin, I had enabled Microsoft’s Two-Factor (or Two Step or Multifactor MFA) authentication to protect my account. (This is what they call foreshadowing)
- We were running Exchange 2010 on-premise, but deployed an Exchange 2016 for the Hybrid connection. Outlook 2016 was the only version of the client in use. We did not test with other versions of the client.
- We had migrated several mailboxes successfully and Outlook automatically reconfigured without issue.
- When my mailbox migrated I could access Outlook online (OWA) without issues but my Outlook client didn’t auto reconfigure as expected. I had the following symptoms:
- Outlook opened and prompted for login to Office 365 credentials as expected. Sometimes it seemed to take a couple tries before it stopped prompting.
- Outlook showed as connected (unfortunately I cannot remember if it said Online or Connected)
- If I looked at my Connection Status (hold Shift and right click on the Outlook icon in the Systray to get the below menu) it showed a connection to the on-premise Exchange 2010 server, but no connection to Office 365
- These symptoms persisted both inside our LAN and when working remotely from multiple machines.
There was no error we could find. Testing the Email AutoConfiguration showed the client successfully redirecting to Office 365’s autodiscover entry, but then a put on errors occurred. The GetLastError of 2147954407 was the first. There was a second, but unfortunately I lost the screenshot. 
The Fix
Eventually just as a test I disabled Two-Factor authentication for my office 365 account. Outlook then immediately reconfigured as expected. There was no article saying this was required. Outlook 2016 supports two-factor officially and I was able to re-enable after Outlook reconfigured itself. Just one of those scenarios that wasn’t in the test case for Microsoft.
Fixing IT 
YES! I spent almost two weeks trying to understand why my outlook after the migration to exchange online was failing, even when all test-email configurations went with flying colors.
Once I disabled 2FA it started to work!
Have you managed to get 2FA working with 2016 outlook client?
We didn’t spend much time trying. We were already Duo users and were able to setup conditional access to integration with Duo MFA which seems to work fine with Outlook 2016.
it works! Who can explain why? if we made a newprofile it worked without bypassing MFA… but outlook only connects when we bypass MFA the first time.
Same exact issue it appears for me. We are working with MS to get root cause.
Hi Matt,
Did Microsoft give you explanation why?
Thanks
No, but to be fair I never contacted them. I think it was just a configuration they weren’t expecting.