Exchange 2016 Outlook Anywhere MFA

Question

I'm trying to implement MFA on On-Premise Exchange Server 2016, I've done some research and followings are my findings.

• Exchange Server can't be authenticated through Network Policy Server RADIUS.
• Any third party MFA provider aren't able to secure Outlook Anywhere / Exchange Active Sync via MFA, All are limited to Web based Apps like OWA / ECP.
• Publishing Exchange through ADFS also secures Web Based Apps with MFA like OWA / ECP as publishing Outlook Anywhere through ADFS isn't possible.
• Azure App Proxy also supports publishing OWA / ECP only and not Outlook Anywhere.
• So the only possibility to have MFA in Outlook Anywhere is to use Hybrid Modern Authentication in Exchange Hybrid Deployment ?

Would be grateful for help.

Answer 1

If I was doing this, then yes, I would use HMA. Its the only solution I know of that covers all the Modern Auth clients.

https://learn.microsoft.com/en-us/microsoft-365/enterprise/configure-exchange-server-for-hybrid-modern-authentication?view=o365-worldwide#add-on-premises-web-service-urls-as-spns-in-azure-ad

Note all the virtual directories "Protected" by HMA

Answer 2

Hi @Mashal Khan ,
The "Answers" in this post details various situations of deploying MFA in Exchange 2016, and provides reference links. You can refer to: MFA on premises Exchange 2016

According to research on the information you porivded and another article, I agree with Andy. You could configure Exchange Server on-premises to use Hybrid Modern Authentication in Exchange Hybrid environment. For more information: Hybrid modern authentication overview and prerequisites for using it with on-premises Skype for Business and Exchange servers

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Thank You anonymous userDavid @Lucas Liu-MSFT | That answers My question.