Exchange Server 2016 On-Premise and 2FA/MFA

Question

Exchange Server 2016 On-Premise and 2FA/MFA

Dhillan Kalyan 56

Hi

I am trying to find some specific info with regards to Exchange Server 2016 on-premise implementation and 2FA/MFA and not finding much luck.

I have a client who is looking to implement a 2FA solution for their on-premise exchange environment. They currently have PingFederate in the environment and are implementing Symantec 2FA as the MFA provider.

From my understanding I believe that we can implement 2FA without any problems for OWA but I have also been asked to investigate the implementation of 2FA for EWS, ActiveSync and the Outlook Mobile app. This is where I cannot find information.

Is it possible to implement 2FA for these services? Please advise

0 comments

6 answers

Your answer

Answer 1

Hi,

To my knowledge, supported services for MFA in Exchange on-premise are OWA/ECP. There are various methods to achieve this,

Using ADFS
Cloud based - Azure
Reverse proxy + cloud based - for instance, reverse proxy can be integrated with NPS for RADIUS and using NPS extension on that server for secondary authentication in Azure
Third party products like PingFederate/Duo and that has the clear documentation on the product itself for configuring MFA for Exchange on-premise

http://msexchangeguru.com/2017/01/16/secure-owa-ecp-with-mfa/
https://practical365.com/exchange-server/exchange-web-services-bypass-multi-factor-authentication/
https://social.msdn.microsoft.com/Forums/en-US/d28e3947-0a19-44d9-b39f-db9a4f6c21f3/mfa-on-premises-exchange-2016?forum=windowsazureactiveauthentication

If the above suggestion is helpful, please click on "Accept Answer" and Upvote it.

Ashok M 6,876 Reputation points

2020-11-03T13:24:06.943+00:00

Hi,

Just to check if there are any updates. If the above suggestion helps, please click on "Accept Answer" and upvote it. Thanks for understanding.

Answer 2

SH-1616 61

Hi,

I had the same challenge and ended using DUO 2FA for Exchange 2016 OWA on premise, the setup and configuration was straightforward
owa

Blauer Admin 6 Reputation points

2022-03-18T14:05:20.343+00:00

I also run 2019 on-prem Exchange and 100+ users all over the USA who use Outlook to connect and hate OWA .. will DUO work for Outlook end users out on the road and how will that work for cell phone users?

Jeff
Chuck 21 Reputation points

2022-09-26T13:29:41.357+00:00

I also run 2019 on-prem Exchange and 100+ users all over the USA who use Outlook to connect and hate OWA .. will DUO work for Outlook end users out on the road and how will that work for cell phone users?

Great question! Ever get a response or try it out?
David McBride 306 Reputation points

2022-09-26T13:34:18.657+00:00

As far as I know, DUO only works with OWA. It does not work with Outlook or mobile apps.
Thanks
SH-1616 61 Reputation points

2022-12-12T12:48:27.577+00:00

Sorry for the late response,

I only tested it on OWA, I have no Idea if it supports Outlook desktop or mobile client.

Answer 3

Keith Clark 1

I also am being tasked with 2FA for OWA onprem Exchange 2016 server. I already have 2FA established throughout the domain and remote users with hardware Yubikey Smart cards. I was hoping I could use these same cards rather than having to now support an additional 2FA solution. Is it possible within exchange 2016 On Prem or 2019 Server to support Hardware Tokens FIDO2 ??? Is there any kind of support for my yubikeys to do 2fa for OWA or am I stuck with having to purchase additional solution?

Frank Lima 1 Reputation point

2022-05-04T18:08:54.307+00:00

I honestly got tired of all the security issues and the problems with CU for exchange crashing exchange.Sorry microsoft but your exchange care and patching has been terrible for a long time.
I personally created a brand new deploy of 2019 with latest CU and all security patch.
I then created a firewall setup to a reputable smart host for spam, virus and maleware and locked nat only to smart host ip for smtp.
Opened owa only for internal function for workstations not having office.
For phones i created ikev2 vpn and once activated on iphone or droid they are free to enjoy securely and dont even need to interact and all encrypted on the cell.

Answer 4

David McBride 306

@Ashok M
My specific goal is to implement 2FA for On-Prem Exchange 2019 multi-tenant. Above you said the goal could be accomplished by various methods. I'm specifically interested in 1. Using ADFS and 2. Cloud based - Azure. I can find articles that talk about these topics but not specifically how to accomplish my goal. Can you give more info on options 1 and 2 please?
Thanks!!

Akanksha Thakur 1 Reputation point

2021-11-09T14:32:09.75+00:00

You can create an Enterprise Application in Azure AD and implement MFA for On Premise Mailbox.

Refer
https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy

https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application
David McBride 306 Reputation points

2021-11-09T14:47:07.903+00:00

@AkankshaThakur-8359 avatar image AkankshaThakur-8359
Thank you so much for the response and suggestion. Unfortunately the higher ups have decided to go an different direction. Thank you again for your input.

Answer 5

Lucas Liu-MSFT 6,196

Hi @Dhillan Kalyan ,
I agree with what AshokM-8240 said.
In addition, if you use a third-party product to set up MFA for ActiveSync and Outlook on mobile, please note that there are requirements for your mobile system. For specific restrictions, please refer to the instructions of each product.

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Lucas Liu-MSFT 6,196 Reputation points

2020-11-05T08:48:01.983+00:00

Hi @Dhillan Kalyan ,
Do suggestions above help? If the issue has been resolved, please click “Accept as answer” to mark helpful reply as an answer, this will make answer searching in the forum easier and be beneficial to other community members as well.

Thanks for your understanding.

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Lucas Liu-MSFT 6,196 Reputation points

2020-11-10T06:27:20.913+00:00

Hi @Dhillan Kalyan ,
I am writing here to confirm with you how thing going now? If the above suggestion helps, please click “Accept as answer” to mark helpful reply as an answer.Your action would be helpful to other users who encounter the same issue and read this thread.
Thanks for your understanding.

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Exchange Server 2016 On-Premise and 2FA/MFA

6 answers

Your answer