This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 60%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
I know that there are 2 (3) ways to disable basic authentication. So, when it comes to disabling basic auth which way is best - Service Side via org settings in Microsoft 365 Admin Center or CA policies? Should you use the two ways I described or is one equivalent to the other?
Best one is the service-side controls, but only Exchange supports that. In addition to the admin center controls, you can also use Auth policies to a similar end: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online
Other methods are still valid, but they only act after credentials have been validated. On the other hand, authentication policies as detailed above act on a pre-auth layer, and block brute force attempts before they even reach Azure AD.
Ok, thanks for replying. That article seems to be only for Exchange so what do we do for other 365 services? CA policies?
Services such as SPO also have some controls to toggle basic auth, but they are "all or nothing" type of switch. So you might as well stick to CA policies.
Ok so is there any real value to using CA policies to block basic auth if you have taken all of the other measures? i.e blocking from the service side and/or the Exchange pieces?
Yes, flexibility. With CA you can only target specific users, or services. Or add exclusions as needed, for example for any multi-functional devices that might not work with Modern auth.
that makes sense. thanks for your time!