exchange 2019 block user group from OWA

Question

exchange 2019 block user group from OWA

David McBride 306

I’m working on an on-prem Exchange 2019 farm that is multi-tenant. I am being asked to find a way to block OWA for just some of the tenants. The tenants are separated by OU, GAL and domain space and etc…. I have browsed to the file system path C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy and set permissions on the OWA directory by adding a test user and setting the explicit Deny on all severs. That user can still log into OWA. Any other ideas?
Thanks!!

0 comments

1 answer

Your answer

Answer 1

Kai Yao 37,791 Moderator

Hi @David McBride

If you would like to disable OWA access for users in specified OUs, I suppose you may use the following command in Exchange Management Shell:

Get-mailbox -OrganizationalUnit "Contoso.com/Tailspintoys" | Set-CASMailbox -OWAEnabled:$false

It would disable OWA for all users in the Tailspintoys OU.

When users enter their credentials to log in OWA, they would see the following error:

You may also do it in Exchange Admin Center.
Here is a link on this topic for your reference: Enable or disable Outlook on the web access to mailboxes in Exchange Server

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

David McBride 306 Reputation points

2021-08-19T13:10:45.303+00:00

Thank you for the info. My apologies but I left out a detail. I have a second OWA site for the second set of users so I can completely disable OWA feature. Just OWA for the default OWA site for a group of users. I want a group of users to have to use 2FA and a group users to not have to use 2FA. Any other ideas would be greatly appreciated.
Thanks!!
Kai Yao 37,791 Reputation points Moderator

2021-08-20T01:40:34.803+00:00

Hi,

Have you followed suggestions in this article: Configuring Multiple OWA/ECP Virtual Directories on the Exchange 2013 Client Access Server Role
It introduces how to setup multiple virtual directories for OWA and ECP.

If you have done it already, I suppose you may setup 2FA on the additional sites to have the specific group users to use 2FA to authenticate OWA.
For example, if you would like to use ADFS, here is also a link about how to setup ADFS for OWA:
Use AD FS claims-based authentication with Outlook on the web
Kai Yao 37,791 Reputation points Moderator

2021-08-24T07:25:20.33+00:00

Hi @David McBride

Just checking in to see if above information was helpful.
Please let us know if you would like further assistance.

Share via

exchange 2019 block user group from OWA

1 answer

Your answer