Originally published: September 20, 2019
Updated: March 18, 2021
Please go here to search for your product's lifecycle.
UPDATE February 25, 2021: Microsoft has postponed disabling Basic Auth for protocols in active use by tenants until further notice but will continue to disable Basic Auth for protocols not in use. Overall scope of this change now covers EWS, EAS, POP, IMAP, Remote PowerShell, MAPI, RPC, SMTP AUTH and OAB. Go here for the full announcement.
Exchange Online is deprecating Basic Authentication for multiple protocols prior to its removal in the second half of 2021. Basic Authentication relies on sending usernames and passwords -- often stored on or saved to the device -- with every request, increasing risk of attackers capturing users' credentials, particularly if not TLS protected.
Basic Authentication is superseded by Modern Authentication (based on OAuth 2.0). Customers are encouraged to move to apps that support Modern Authentication prior to the removal of Basic Authentication.
As part of security defaults, we currently disable Basic Authentication by default for new customers. During 2021, we'll start to disable Basic Authentication for existing customers who have no recorded usage of Basic Authentication in any of the protocols in scope of this announcement. After this change, apps will not be able to use Basic Authentication when connecting to Exchange Online using those protocols.
This change currently affects commercial M365, not our consumer service Outlook.com users, and it impacts Exchange ActiveSync (EAS), IMAP, POP, and Remote PowerShell.
Multifactor authentication helps secure your environment and resources by requiring that your users confirm their identity by using multiple authentication methods, like a phone call, text message, mobile app notification, or one-time password. You can use multifactor authentication both on-premises and in the cloud to add security for accessing Microsoft online services, remote access applications, and more. This learning path provides an overview of how to use multifactor authentication as part of a cyber
Plan and execute an endpoint deployment strategy, using essential elements of modern management, co-management approaches, and Microsoft Intune integration.
Admins can learn how to use the SMTP AUTH report in the new Exchange admin center to monitor email senders in your organization that use authenticated SMTP (SMTP AUTH) to send email messages.
Please go