Hi Gabriele,
To check tracing log for further dig into the sign in error, we would suggest you take a look at “Lync-UccApi-0” log file under the tracing folder.
The following example displays a successful authenticated sign in flow when you get 200 OK prompt right after the three continuous 401 unauthorized reminder.
But if you have problem with signing in, you will not get 200 OK reminder.
Then please try to figure out the red error before you can see the three continuous 401 unauthorized reminder occurs, the three 401 reminder is a must during the successful work flow. Sometimes it will be corrupted by two continuous 401 error, sometimes
only one 401 error prompts, in this case please dig into the issue right after the 401 error.

As to the sign in work flow, you could check as follows when you investigate the tracing log.
Generally
the client does a DNS lookup via an auto-discovery process. If the domain is contoso.com, the path for signing in follows this order of DNS query:
1.lyncdiscoverinternal.contoso.com (A record for the Autodiscover service for internal connections directed to internal Web services)
2.lyncdiscover.contoso.com (A record for the Autodiscover service for external Web services)
3._sipinternaltls._tcp.contoso.com (SRV record for internal TLS connections)
4._sipinternal._tcp.contoso.com (SRV record for internal TCP connections)
5._sip._tls.contoso.com (SRV record for external TCP connections, auto login for external client, pointing to access.contoso.com)
6.sipinternal.contoso.com (A record for the Front End pool)
7.sip.contoso.com (A record for the Front End pool when the client is on the internal network; A record for the Access Edge Server when the client is external with no VPN access)
8.sipexternal.contoso.com (A record for the Access Edge Server when the client is external with no VPN access)
To initiate discovery, the client takes the domain portion of the entered user's SIP URI and composes a DNS lookup request for lyncdiscoverinternal with an appended domain.
In conclusion, for all Lync clients during logon, the DNS query process continues until a successful query is returned or the list of possible DNS records is exhausted. If all possible
DNS records have been returned to the Lync client and the client wasn't able to sign in, an error is returned. After a client request is received, Autodiscover will locate the home pool FQDN for external and internal web services and then start the authentication
process.
You could also check the technical diagram in the following
introduction on how the flow goes and what the network and server requirements are.
By the way, if you connect with VPN at home, the sign in flow won’t go with Edge server and just like the work flow you are connecting with internally network.
Kind regards,
Calvin Liu
Please remember to
mark the reply as an answer if you find it is helpful. It will assist others who has similar issue. If you have feedback for TechNet Subscriber Support, contact
tnsf@microsoft.com.
Click
here to learn more. Visit the dedicated
forum to share, explore and
talk to experts about Microsoft Teams.