MS Teams, Microsoft SSO Extension - Teams Sign In Error 1000, 1001,1002 Fix

[Levi_]

Hey Everyone,

Ran into an issue today that was out of the blue and fun I think would be helpful for some of you. Earlier today a couple of my users were signed into Teams and sat them at a disconnected screen and to sign back in. After relaunching Teams it brought them to a "We Ran Into Trouble 1002" and a "Something Went Wrong 1001(or 1000)" error page. Effectively making them unable to open and even attempt to sign into Teams.

Troubleshooting through this and blowing out the cache in ~/Library/Application\ Support/Microsoft/Teams/Cache and a restart did not resolve it and there are no Microsoft Teams Identities Cache entries in the Keychain to remove either if you are using either or both Jamf Connect and the Microsoft SSO Extension. 

To resolve this I had to delete the Teams Cache folder from the machine, un-scope the MS SSO Extension to the device and after a restart the user is prompted to sign into Teams again without an issue. I believe this is stemming from an issue of users not updating their passwords properly via Jamf Connect or it could be just an issue with Teams itself. The article below on the MS Forums covers the reported problem of Error 1000-1002 and the resolution however if you have the MS SSO extension enabled you will just keep going in circles. 

I hope this saves someone some time.

Resource Link demonstrating problem and solution for those not using the MS SSO Extension
https://answers.microsoft.com/en-us/msteams/forum/all/teams-for-macbook-not-signing-in-something-wen... 

[tonyyoung2]

After you resolved the issue, did you throw the SSO extension back onto the system? Or left the system out of scope for now?

[Levi_]

I forgot to post that. For now I have left the machines out of scope. I mainly rely on the SSO extension to auto login users to their apps at first setup and our VPN so for now it will be okay. When I have time to test more with the users as they have downtime I will post an update. Unfortunately I could not duplicate the issue on a test machine likely as my test machines passwords are updated properly. 

[msa57]

After half of our fleet started to have the same problem with MS Teams today, I disabled the configuration profile "Microsoft SSO Extension" and this helped the users to re-enter MS Teams for now as a workaround.

[tonyyoung2]

Likewise. Completely yanked our SSO profile from the entire fleet.

[mbrown2157]

Same issue here with a few of our users.  I have a Microsoft ticket opened, I will post if I find out anything.  I have not been able to reproduce this on my device, so troubleshooting will be difficult.

[RolindaS]

Hey @mbrown2157 did you receive any feedback from Microsoft, I too am experiencing this issue.

[MMTechno]

Hey do you have any news about the issue that you can share? 

Do you by any chance have TLS inspection enabled on your network?

https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-mac-sso-extension-plugin?tabs=...

https://support.apple.com/en-gb/101555

[fjespinoza]

We are experiencing the same issue with our users as well. Another thing that I noticed is that this issue is happening on our Monterey 12.2 computers. Right now, excluding the computer from the SSO is working. 

[ash_mac]

Company Portal had an update on Oct 23rd (5.2310.3) that seems to have brought in this behaviour and we have raised a case with MS, seeing the issue on Sonoma and Ventura machines.
Luckily I got stung with the issue this morning and have managed to capture logs and wireshark etc to pass on, hopefully its fixed in a newer version.
I also downgraded my Company Portal and was able to use the plugin but then MAU updated it and I was dead in the water again. 
For now we are unscoping devices with the issue and debating if we unscope the whole fleet as its great when it works.

[Levi_]

I also use MAU to update the company portal application and am on 5.2310.3. My two test Macs on macOS 14.0 with the updated teams client, Classic & School or Work do not experience this issue with the SSO extension. I spooled up a new Mac today with a test account and SSO extension scoped, it did not experience the problem on 13.0 or 13.6. I tried installing an older teams client on a Mac with the problem and it signed in as expected. MAU grabbed it and updated Teams shortly after then it was zapped until the SSO profile was removed.

So far I've seen this impacting Monterey, Ventura & Sonoma. Has anyone tried setting up a new Mac with the SSO profile scoped and testing Teams yet? I've been busy working on other issues(ISE), but tomorrow I too will open a ticket with my MS premier support and see where it goes and post updates back.

[ash_mac]

There is a thread on MacAdmins slack about this too, Microsoft has rev'd Company Portal 4 times in the last 24 hours.
In my testing, having SSO scoped and an older version of Company Portal (5.2309.x), Teams Classic and Teams School or Work both work fine, once MAU updates the Company Portal the 1001 errors begin, even with the latest rev of the Company Portal (5.2310.4). Once you downgrade the Company Portal it starts working again. I have also had success with just restarting the machine or resetting Teams as it seems to be OK with MOST new connections, its when the connection pre-exists and is being renewed it really seems to get stuck. Will wait and see what MS comes back with from the logs and findings supplied, the fast rev'ing of the Company Portal makes me think its on their radar and will be "better" soon....

[mbrown2157]

I now see version 5.2310.4 of company portal was released last night and looks like it fixed it on the my test device.  Please confirm if you can.

[ash_mac]

5.2310.4 has improved things, still seeing some users with issues but not sure if thats processes that haven't closed off since the update etc

[sjpacker]

Resurrecting this thread as it seems this issue is recurring in 5.2310.5. Was anyone able to find a more permanent solution for this?

[mbrown2157]

I just checked both new and classic teams and mine are still working.  Looks like mine was updated to 10.2310.5 on November 15th.

[sjpacker]

We've had our SSO extension disabled since October when this first reared its head. Tried re-enabling it since I saw folks saying newer versions of Company Portal seemed to resolve the issue. Just built a new M3 Max MacBook Pro on Sonoma 14.2 we got in this week and attempted re-enabling SSO for the new build and it worked fine for a few days then suddenly today it decided it was time to rear its head again. Tried all the remediation steps outlined here, but nothing worked to resolve it outside of just disabling it again. Think we'll be keeping this disabled for the time being until a more clear root cause and remediation is identified.