Exchange 2013 OWA / Multiple Login prompts

Hi community,

i know this was discussed heavily before, but i want to get some insight first.

Environment:

XG310 (active-passive)

Two Exchange Servers 2013 CU15

Issue:

When accessing the OWA Site i get a sophos prompt where i need to enter my AD-credentials (username and password, not upn-style). After entering the creds i´m forwarded to the OWA-Loginpage from Exchange.

I have created a firewall policy and a WAF-Rule but it seems that i have not fully understood the security concepts of basic auth / form-based auth.

The posts that i found so far are either old and for Exchange 2016 or for Sophos UTM and not XG.

Maybe it´s useful that i post my config here:

Webserver:

Firewall Business Application Rule:

Part2:

Part3:

Thanks!