I am currently testing out Office 2013 with ADAL which is currently in preview. With ADAL, the Office applications support "Modern Authentication" which means web redirects instead of using the old basic authentication and "proxying credentials" through Office 365. I followed the guidance and enabled ADAL. However, despite of using ADFS and having the adfs website added as an "intranett site" in security settings in IE, all I got was forms based authentication and not single sign-on as I expected. I contacted the Microsoft product group and verified that this was indeed supposed to work and was one of the primary use cases.
If you enable the TCOTrace registry key, the %temp%\outlook.exe.txt logfile is created and here I found the following entry:
ADAL: message='Could not discover endpoint for Integrate Windows Authentication. Check your ADFS settings. It should support Integrate Widows Authentication for WS-Trust 1.3.', additionalInformation='Authority: https://login.windows.net/common
To fix this, you need to enable an ADFS endpoint that is disabled by default. To do this you need to run the following PowerShell cmdlet and restart the ADFS service on all servers in the farm.
Enable-AdfsEndpoint -TargetAddressPath "/adfs/services/trust/13/windowstransport"
Now it should work, with ADAL giving you perfect SSO from your Office applications.
Another bug
I also encountered a bug that Microsoft is fixing (also verified after contacting the product group) in the April update. If you find a log line saying CheckADUser: Not AD user found in the log file, even though you are a domain user, you have encountered this bug. To fix, close all Office apps and delete the following registry key below and try again: HKCU\Software\Microsoft\Office\15.0\Common\Identity\SignedOutADUser
After deleting the registry key, ADAL should not try Integrated Windows Authentication instead of Forms Based Authentication.
