Azure MFA Causing Outlook Desktop App Password Issue

[Gongalong]

Hi folks,

 

I'm tinkering with enabling Azure MFA, following the guide here https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa

 

So far the only problem I've noticed is that it seems to cause an issue with the Outlook desktop app. Some minutes/hours after enabling the desktop app starts prompting for a password. I don't get any two factor request in the authenticator app, and despite entering the correct password it just keeps popping up the same request.

 

Anyone else come across this?

 

Thanks

[Gongalong]

Should have googled. Looks like I have to turn on Modern Auth in 365 admin, then remove any stored passwords in credential manager, and potentially recreate the Outlook profile. Not working yet, but I'm guessing enabling the setting in 365 might require time to take effect.

[chaplic]

Also if your'e... err... that far behind the curve, could you be using Office2013 which needs reg settings for modern auth (2010 will not work)

[Gongalong]

Mostly Office 365 apps here. The Outlook app seems fine now, but there doesn't seem to be any MFA as part of its setup which surprises me. So if someone has my credentials they can just setup Outlook and access email?

[chaplic]

MFA wont be turned on by default on an old tenant. You need to turn it on either per user, or use conditional access to require MFA

[Gongalong]

Yes, as part of the tinkering I've created a conditional access policy (and I've now enabled modern authentication). It prompts when using the Outlook web app, but I don't get any prompt with the desktop app. I can imagine it would be a right pain with the latter depending when it prompts, if it can be configured to prompt?

[gaz350b]

As a part of moving to 2fa I would also make sure you are disabling basic authentication. Otherwise 2fa can be bypassed.

 

Verify who is still using “Legacy authentication” because all your users with non-outlook Clients like iOS and Google users will need to delete and add their email.

 

Use the sign in logs in azureAd to see how ready you are. It took us a good month to move everyone off legacy auth. We eventually just turned it off because the last few people were impossible and would never reply to emails or make themselves available.

 

(They turned up that day after disabling)

Edited April 16, 2022 by gaz350b

[chaplic]

Yes, as part of the tinkering I've created a conditional access policy (and I've now enabled modern authentication). It prompts when using the Outlook web app, but I don't get any prompt with the desktop app. I can imagine it would be a right pain with the latter depending when it prompts, if it can be configured to prompt?

 

Good advise from Gaz

 

You can target web apps and desktop apps separately for MFA policies. In general you don't need to fiddle with token lifecycle (which would define how often you reauthenticate) and once MFAs users on laptops are going to have a pretty hassle free experience. If you access internet from a fixed IP, it's common to exclude that from MFA requirement, basically saying that the trusted IP is a second factor auth, though you'll need to judge the tradeoffs in this

[gaz350b]

We actually configure admin accounts to 2fa every 24hrs as we are really bad for leaving sessions open in our browsers so conditional access boots us out.

[DaveTheTech]

We turned MFA on, the realised some time after that legacy auth was still a problem.

To stop this, Conditional Acess was enabled to report only.

 

PS script / signin page to go through and work out what/who was being effected.

 

After a week or two of sortin the above, legacy auth was tunred on and conditional access was enforced.

--The above problem wasn't an issue for our admin accounts.

Good point about the admin sessions. I must get round to suggesting that.

Edited April 18, 2022 by DaveTheTech

[Gongalong]

How many of the basic auth protocols should be switched off? There's a fair few:

 

Outlook client = I'm guessing this is a bad idea if we've got users with the desktop app

Exchange ActiveSync (EAS) = no idea

Autodiscover = I'm guessing this is also a bad idea if we have desktop app users

IMAP4 = I'm guessing this should be off

POP3 = Ditto for this

Authenticated SMTP = I'm guessing this is less of an issue as it's more for sending emails, albeit could be used to hijack and spam

Exchange Online PowerShell = I'm guessing this is best left alone

[gaz350b]

The main issue is basic auth can be used to do spray attacks and work out passwords.

 

So You should work towards disabling them all.

Exchange power shell has a modern auth module but I can’t stress enough monitor logs, migrate users/processes to modern auth and to an acceptable level you won’t catch everyone then turn it off.

 

We did a “change” email advertising what they needed to do and then targeted emails “our logs show that you use mail app on iOS follow these instructions to delete/add again using our new authentication and read failure to complete will result in no email at xxx date on your device”

 

After desktop app switched which should be easssssy. Checkout the other thread on turning off basic auth too.

 

I would focus on EAS, imap/pop 1st

If you have any internal applications using authenticated snmp migrate them to at least to your “o365 connector” (research how to connect a printer to o365 without auth)

 

We also migrated things like our help desk to fresh desk because our old one didn’t support modern auth. So it’s not just end users you need to think about.

Edited April 20, 2022 by gaz350b