Has anyone used PowerShell to disable basic authentication?

Question

Here's how:

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online

There was a hint in the article that one reason to do it is to stop repeated attacks on the myriad legacy protocols, but we're not seeing that it helped. According to Sign-Ins in AAD, even days later, there are still the usual login attempts from China etc. against Exchange Online. Unfortunately, the log isn't specific about how these attempts are being made, so there's no proof that it's via basic authentication.

Yet, I have seen some comments from people saying that it stops this problem cold, so what I'm seeing is quite puzzling.

Answer 1

Hello there,

According to your test disable basic authentication working as expected (When I try to login against IMAP, no matter how many times I do it , those attempts never reach the AAD log).

About hackers query you should submit your feedback to Office 365 UserVoice.

Thanks,

Answer 2

Done. I also included some bonus PowerShell results to paint a more complete picture.

Answer 3

Hi Rseiler,

Thanks for the reply. I totally understand your concern. However, Blocking Basic authentication can help protect your Exchange Online organization from brute force or password spray attacks. This feature as it helps prevent these types of attacks from compromising our data and users.

Please connect to Exchange Online PowerShell run the following cmdlet below and provide us output result screenshot via the private message.

Get-Recipient -RecipientTypeDetails usermailbox -ResultSize unlimited | Get-User | Format-Table Displayname, Authentic*, sts*

Moreover, regarding “According to Sign-Ins in AAD, even days later, there are still the usual login attempts from China etc. against Exchange Online”, could you please also provide us with the detailed information/screenshot about the issue via Private Message for further analysis.

Your understanding will be highly appreciated.

Best regards,

Shyamal

Answer 4

Yes, I saw that, but none of those caveats really apply (#1--all users are blocked from basic auth; #2 long since done; #3 N/A).

What I'm hoping to achieve here is hearing whether or not people have seen a change in the rogue login attempts after doing this.

Answer 5

Hello there,

This is comment from MS "We had been holding back on moving from private to public preview primarily due the first two of these - a tenant admin could misconfigure something and not realize until it’s too late due to the lack of reporting and the delayed effect of policy change."

There are three important caveats to this feature:

#There is a lack of telemetry for tenant admins allowing them to report on which users are using Basic Auth (and with which protocol) and once a block is enabled, whether such traffic was blocked. In other words, we can’t really tell you how well the block is working.

A policy change can take up to 24 hours to take effect, unless the admin calls a cmdlet (such as Set-User) to ‘tickle’ each user. (Note that ‘tickling’ is a technical term, first used here). So the block might not kick in right away, and you might have

to take some action if you want it to happen faster.

#If a user’s identity has not been replicated to Azure AD/Exchange Online, they will not be blocked and so any request received by Exchange Online will be routed to the authoritative Security Token Service (STS) where it is likely to fail. This same behavior also means that any authentication requests for unknown users in a tenant (such as might happen during a password spray attack) will also be forwarded to the authoritative STS for the domain.

Scroll down the blog and logged in to post a comment. The Exchange Team will help you understand this feature https://blogs.technet.microsoft.com/exchange/2018/10/17/disabling-basic-authentication-in-exchange-online-public-preview-now-available/

Or you can go to the Feedback and sign in to comment https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online

Thanks,