Implementing Modern Authentication. Which Basic Authentication Methods to Disable?

[Gongalong]

Hi folks,

 

I have enabled Modern Authentication, as I did not realise it was off for our tenancy.

 

I now want to improve security, and turn off any unnecessary basic authentication protocols. We have clients that use the following:

 

Outlook Web App

Outlook 2016 and newer

Outlook App on iOS and Android

 

Can I turn off all basic authentication protocols, or should I leave any of them switched on for the above to work?

 

If I turn off the basic authentication protocols will it require staff to delete and recreate their account in the Outlook Desktop App and smartphone apps?

 

Thanks

[gaz350b]

Top half of this page should cover most of your query. https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online

 

Modern authentication is basically a webpage so OWA uses it by default. When users get a OS type login this is basic auth. Outlook should prompt but doesn’t always.

 

Now modern authentication is turned on start monitoring AzureAd sign in logs. This page outlines most of the Outlook client.

 

https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-auth-and-exchange-online-february-2020-update/ba-p/1191282

 

I believe outlook app on iOS acts the same as outlook and should present the new modern auth login.

 

Non-outlook clients such as mail app will need to be deleted and recreated for modern auth to work otherwise when it’s disabled you will get constant password prompts.

 

Monitor the azure ad legacy auth logins using filters and migrate users as needed.

[gaz350b]

Just to note there is a reg setting that forces a client to use modern auth in outlook but we only needed it once during testing most had swapped over automatically.