Exchange ActiveSync with Azure AD Application Proxy

Question

Hello Microsoft,

We are looking to publish our ActiveSync from on-premises Exchange using the Azure AD Application Proxy. Our goal is to enable MFA and use conditional access policies onto ActiveSync.

Is this type of setup supported now? I've seen some older posts indicating that it was not supported by the Exchange team, I was wondering what is the consensus now.

Thanks

Answer 1

From what I understand, you can use Pass through auth to do this:
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-faq

I would also look at HMA:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/hybrid-modern-auth-overview?view=o365-worldwide

Exchange ActiveSync clients (e.g., iOS11 Mail)
Exchange ActiveSync
For Exchange ActiveSync clients that support modern authentication, you must recreate the profile in order to switch from basic authentication to modern authentication.

Answer 2

@Nelson Ma Did you manage to achieve your goal with Pass Through or HMA?

I have exactly this challenge, however the end user device is iOS and the mailbox is to be accessed through the native mail app (Basic Auth). How do I present EAS auto discovery url externally through App Proxy?

Thanks.

Answer 3

Anyone ever figure this out? I have an onprem exchange server working fine for OWA through azure app proxy. However, I want to fully remove access from the outside to my exchange server except through the app proxy but activesync and outlook anywhere break.