Exchange 2016 iapp - SSO for Outlook - Domain Joined machines

I'm running 2016 iapp, with APM. Outlook installed on domain joined machines gets a prompt when logging in, Outlook installed on a non-domain joined machine does not. Also must enter UPN or domaind\user name at the Outlook prompt.

 

I created an ad query to grab UPN, set session.logon.last.username to UPN, I can see it good in variables, still get the prompt.

 

Also tried setting session.logon.last.logonname to UPN, still get the prompt.

 

I have outlook clients connect with NTLM set in the iapp. But I have tried this with Outlook clients connect with basic, results for this prompt are not different.

 

In one of the sessions established by OUtlook, I casee the error: Found HTTP 401 response for SSO configuration '/Common/Profile-name/exch_ntlm_sso' type:'ntlmv1'

 

I get this same error with SSO set to ntlmv1 or ntlmv2