Outlook Autodiscover Finds Wrong Tenant: Fix

When Outlook connects to the wrong Microsoft 365 tenant, you see a login prompt for an unfamiliar account or receive authentication errors. This happens because Autodiscover looks up the domain’s DNS records and may resolve to an old or incorrect tenant ID instead of the current one. The wrong tenant issue often occurs after a domain migration, company acquisition, or when multiple tenants share the same domain namespace. This article explains why Autodiscover picks the wrong tenant and provides step-by-step fixes to force Outlook to connect to the correct tenant.

Why Outlook Autodiscover Finds the Wrong Tenant

Autodiscover uses a specific lookup order to locate the Exchange endpoint for a user’s email address. The process starts with a local SCP lookup in Active Directory for domain-joined computers. If no SCP is found, Outlook queries the root domain Autodiscover URL (autodiscover.yourdomain.com). If that fails, it falls back to an HTTP redirect from the root domain (yourdomain.com) to an Autodiscover endpoint. The redirect step is where the wrong tenant gets introduced.

When a domain is migrated from one Microsoft 365 tenant to another, the old tenant may still have an HTTP redirect in place. For example, yourdomain.com might redirect to autodiscover.oldtenant.onmicrosoft.com. Even after you move the domain to a new tenant, the old redirect can remain active in DNS or as a CNAME record. Outlook follows this redirect and attempts to authenticate against the old tenant, causing the wrong tenant prompt.

The Autodiscover Lookup Order

Outlook checks Autodiscover endpoints in this exact sequence:

1. Service Connection Point (SCP) in Active Directory (domain-joined only)
2. https://autodiscover.yourdomain.com/autodiscover/autodiscover.xml
3. https://yourdomain.com/autodiscover/autodiscover.xml (HTTP redirect)
4. DNS SRV record for _autodiscover._tcp.yourdomain.com

If step 3 returns a redirect to a different tenant’s Autodiscover URL, Outlook follows it. This redirect is the most common cause of wrong tenant detection.

Steps to Force Outlook to Use the Correct Tenant

The following methods prevent Outlook from following HTTP redirects or explicitly point it to the correct Autodiscover endpoint. Apply Method 1 first. If the problem persists, combine it with Method 2.

Method 1: Disable Autodiscover HTTP Redirects via Registry

This registry change tells Outlook to ignore HTTP redirects during Autodiscover. Outlook will only use the direct HTTPS URL and DNS SRV records.

1. Open Registry Editor
   Press Windows key + R, type regedit, and press Enter.
2. Navigate to the Autodiscover key
   Go to HKEY_CURRENT_USER\Software\Microsoft\Exchange\AutoDiscover.
3. Create the ExcludeHttpRedirect DWORD
   Right-click the right pane, select New > DWORD (32-bit) Value. Name it ExcludeHttpRedirect.
4. Set the value to 1
   Double-click ExcludeHttpRedirect, set Value data to 1, and click OK.
5. Restart Outlook
   Close and reopen Outlook. The change takes effect immediately.

Method 2: Set an Explicit Autodiscover URL in the Outlook Profile

This method forces Outlook to use a specific Autodiscover URL for a given email profile. It bypasses the entire lookup sequence.

1. Open Registry Editor
   Press Windows key + R, type regedit, and press Enter.
2. Find the Outlook profile key
   Go to HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles. Replace 16.0 with your Outlook version: 15.0 for Outlook 2013, 16.0 for Outlook 2016, 2019, 2021, or Microsoft 365.
3. Locate your email profile
   Expand the Profiles key. You will see one or more subkeys named Outlook, Default Profile, or a custom name. Select the profile that contains the misconfigured account.
4. Find the Exchange account GUID
   Under your profile key, expand the 9375CFF0413111d3B88A00104B2A6676 subkey. Each subkey under it represents an email account. Click each to find the one with the SMTP address of the affected mailbox.
5. Add the AutoDiscoverUrl string
   Right-click the account GUID key, select New > String Value. Name it AutoDiscoverUrl.
6. Set the correct Autodiscover URL
   Double-click AutoDiscoverUrl and enter the correct URL. For Microsoft 365, use: https://outlook.office365.com/autodiscover/autodiscover.xml. For Exchange on-premises, use your internal URL.
7. Restart Outlook
   Close and reopen Outlook. The profile now forces the correct Autodiscover endpoint.

If Outlook Still Connects to the Wrong Tenant

After applying the registry fixes, some users still see the wrong tenant. The remaining causes involve DNS records or cached credentials.

Outlook Keeps Prompting for the Old Tenant Credentials

Windows Credential Manager stores cached credentials for the old tenant. Clear them:

1. Open Control Panel > User Accounts > Credential Manager.
2. Click Windows Credentials.
3. Look for entries containing the old tenant name, such as MicrosoftOffice16_Data:ADAL:oldtenant.onmicrosoft.com. Remove each.
4. Restart Outlook.

DNS Still Points to the Old Tenant

Check your domain’s public DNS records. The CNAME record for autodiscover.yourdomain.com might still point to the old tenant. Remove or update it to autodiscover.outlook.com for Microsoft 365. If using a third-party DNS provider, verify the record changes propagated.

Multiple Tenants Share the Same Domain

If your organization was acquired or merged, the old tenant may still hold the domain as a verified domain. The old tenant’s Autodiscover redirect remains active even after the domain is removed from the old tenant. Contact the old tenant’s admin to remove the domain entirely. Then verify the domain in the new tenant and update DNS.

Autodiscover Redirect vs Direct URL: Key Differences

Item	HTTP Redirect (Autodiscover)	Direct Autodiscover URL
Lookup method	Follows HTTP 302 redirect from root domain	Direct HTTPS request to specified URL
Tenant binding	Redirect URL points to old or wrong tenant	Explicitly targets the correct tenant endpoint
Configuration	Controlled by DNS CNAME or HTTP redirect	Set via registry or Group Policy
Security	Vulnerable to redirect hijacking	Reduces attack surface by skipping redirects
Recovery after migration	Requires DNS cleanup and old tenant removal	Instant fix with ExcludeHttpRedirect or explicit URL

Outlook now connects to the correct tenant after you disable HTTP redirects or set an explicit Autodiscover URL. Verify the connection by sending a test email and checking the account settings in File > Account Settings > Account Settings. For ongoing management, deploy the ExcludeHttpRedirect setting via Group Policy to all workstations in your organization to prevent future tenant mix-ups after domain migrations.