Modern Auth

Question

Modern Auth

VickVega 96

Hello,
The existing on-prem environment can not support Modern Auth due to Exchange 2010 SP3 + latest CU and Lync 2013. The users' mailboxes are in Exchange Online. Federation against the on-prem environment is in place. Within Azure AD Connect - no SSO, no password sync, no Exchange Hybrid. Although on the Exchange side - HCW is in place. Currently, web-based applications such as azure portal, Teams, etc are protected by Conditional Access invoking MFA. The desire is to protect fat Office clients with MFA as well. This is the current state.
If Modern Auth is enabled on the tenant only, what are the implications for the users?
We are aware it is not an ideal state - What are the minimal steps to adjust the environment that needs to be taken to allow users to authenticate with Office fat clients and get MFA?

I want to make sure I interpret the following statement correctly:
https://learn.microsoft.com/en-us/microsoft-365/enterprise/hybrid-modern-auth-overview?view=o365-worldwide
"The availability of modern authentication is determined by the combination of the client, protocol, and configuration. If modern authentication is not supported by the client, protocol, and/or configuration, then the client will continue to leverage legacy authentication."

Does this means that if I enable Modern Auth in the cloud, users with Office2016+ (or 2013 with reg key) will be able to use MFA with fat clients?

Thank you.

1 answer

Your answer

Answer 1

KyleXu-MSFT 26,396

@VickVega

If Modern Auth is enabled on the tenant only, what are the implications for the users?

Here is detailed information about it: What changes when I use modern authentication?. As you said, there exist Exchange 2010 SP3 and Lync 2013 for local AD, you cannot deploy hybrid modern authentication for them.

Since mailboxes migrated to Exchange online, you don't need to consider hybrid modern authentication, why not uninstall local AD and use Exchange online modern authentication directly: Enable or disable modern authentication for Outlook in Exchange Online

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

VickVega 96 Reputation points

2021-08-10T05:16:56.663+00:00

Thank you for your input, I have read through those articles before and still do not have my answer. All of them describe how things SHOULD be done, without indicating any consequences.
You cant seriously suggest uninstalling AD, as there resources that rely on it. Seems like you joking.

What actually happens when I enable MA in the cloud and NOT on-prem?
What users will experience?
Will users be able to connect, or they constantly will be prompted for authentication?
If they will be able to use Office fat clients, will MFA work? I suspect NOT, as the authentication on-prem does not match with the cloud settings.
KyleXu-MSFT 26,396 Reputation points

2021-08-10T10:07:25.637+00:00

Indeed, after syncing AD account to Azure AD, and migrate mailboxes to Exchange online, you could remove local AD environment. How and when to decommission your on-premises Exchange servers in a hybrid deployment But, you may retain AD for other purposes, it is decided by your needs.

About your doubts, after migrating mailboxes to Exchange online, you could enable MA from Exchange online side and configure MFA for those mailboxes(Outlook client doesn't support phone as MFA). The experience is same to Exchange online hosted mailboxes.
VickVega 96 Reputation points

2021-08-10T14:00:38.46+00:00

Thank you, I completely aware of the requirements around maintaining Hybrid Exchange for management purposes.
KyleXu-MSFT 26,396 Reputation points

2021-08-12T10:04:20.54+00:00

After migrating mailboxes to Exchange online, you could enable MFA from Exchange online side.
VickVega 96 Reputation points

2021-08-12T16:13:57.31+00:00

MFA is enabled. It is working for "web apps", it's NOT working for fat clients, due to MA not turned on.
That was the purpose of my question - if there would be any issues with access if MA enabled in the cloud ONLY and NOT on-prem.
KyleXu-MSFT 26,396 Reputation points

2021-08-13T08:09:30.46+00:00

About that you need to use the supported version of Exchange server and Outlook client, then enable HMA for them.
KyleXu-MSFT 26,396 Reputation points

2021-08-16T09:23:49.487+00:00

Any update about this thread now?
VickVega 96 Reputation points

2021-08-30T17:37:14.077+00:00

There seems to be no impact for on-prem applications, if Modern Auth is enabled in the tenant.
KyleXu-MSFT 26,396 Reputation points

2021-08-31T09:43:21.887+00:00

Thanks for your update and sharing. It same to the mailbox created on Exchange online.

Share via

Modern Auth

1 answer

Your answer