Thank you for help. You are right, they are authenticating through the e-mail domain controller.
Management policies is an option our management will not go with it unless they have a list of options/alternatives where they can compare and choose the proper based on their environment. Therefore, I still have the same question and I hope to get any other alternatives.
Thank you again.
