Configuring Outlook 2016 - Certificate Based Auth

Configurations steps

1. Add registry values for Autodiscover, MAPI and EWS  (MAPI and EWS are new keys that should be added first) - See Step 8 here: https://docs.microsoft.com/en-us/previous-versions/exchange-server/exchange-150/dn960152(v=exchg.150)
   
   1. Also RPC for Exchange 2013
      
2. Install on the client machine: a client certificate as well and CA of the server certificate. Add certificate in Windows Credential Manager for required auto-discover and EWS hostnames like this:
   
3. Add records to DNS that will point to Bastion.
4. Add account with credentials to Outlook

5. Configure Bastion XML to require client certificate in listener for Autodiscover/ EWS - both are supported