Microsoft basic update#

If we have not disabled Basic Auth for any protocols weвЂ™ll tell you just that. Once you click Run Tests, the tool will check your tenant settings to see if we have disabled Basic Auth for any protocols, and then display the results. Once you do that, youвЂ™ll see a page very similar to this: Published on one of the most popular blogs weвЂ™ve ever had at Microsoft. (DonвЂ™t tell anyone, this is our little secret. But if you want to get straight to the new Basic Auth self-help diagnostic simply enter the magic phrase вЂњ Diag: Enable Basic Auth in EXOвЂќ. Once you do that you enter the self-help system which, (in case you didnвЂ™t know) can use some very clever logic to help you find a solution to all kinds of problems. If you want to re-enable a protocol that we have disabled for Basic Auth, or want to see what protocols we have disabled, open the Microsoft 365 admin center and click the small green ? symbol in the lower right hand corner of the screen. These diagnostics have proven really popular with customers, so we simply built on that technology. You may have seen this before for things like EWS migration throttling, or you read this excellent recent post about it. WeвЂ™ve built a new diagnostic into the Microsoft 365 admin center. What if we do not spot that new usage, and we disable Basic? What then? Well, thatвЂ™s where a new tool weвЂ™ve been building comes in вЂ“ a tool that provides self-service re-enablement. Now therefore is another great moment to plug the Azure AD Sign-In log, as it can help surface вЂunexpectedвЂ™ usage. You should know that we canвЂ™t really tell if Basic auth usage is legitimate usage, or an account that has already been compromised вЂ“ we just see this as someone logging in to the mailbox, and in this case will not disable the protocol. Why would we get it wrong? Well, very low usage is hard to detect if connections are rare, and some customers might even suddenly start using Basic auth. WeвЂ™ve already done this for a pilot set of tenants so we feel good about how this works, but before we scale up we wanted to build a tool to help our customers just in case we get it wrong. 30 days later, weвЂ™ll turn it off and send another Message Center post to confirm it was done. The process is: WeвЂ™ll randomly select customers with no usage in any, or all affected protocols, send them a Message Center post informing them that in 30 days weвЂ™re going to turn off Basic Auth. And weвЂ™re going to start turning it off for those who are not using it. We have been busy analyzing Basic Auth usage data for our customers and now have a solid understanding of who uses it and who does not. (* as previously announced these are: Exchange Web Services (EWS), POP, IMAP, Exchange ActiveSync (EAS), Remote PowerShell (RPS), Outlook (EWS + MAPI, RPC, and OAB) and SMTP AUTH) For customers that use still Basic for some or all the affected protocols*, we are not touching authentication settings for those protocols (for the time being). The ProcessДЄs weвЂ™ve said before, weвЂ™re only currently planning to turn off Basic Auth for those customers who are not using it. Over the last few months, we have been building the supporting process and tools we need to do that at scale, and now weвЂ™re ready to start rolling it out. Many of them donвЂ™t know Basic is enabled, and the risks that it presents вЂ“ so we are going to do our bit to help secure their data by turning it off for them. We have millions of customers who have Basic Auth enabled in their tenant, but only use Modern Auth.

Microsoft basic update#

ItвЂ™s been a few months since our last update on Basic Authentication in Exchange Online, but weвЂ™ve been busy getting ready for the next phase of the process: turning off Basic Authentication for tenants that donвЂ™t use it, and therefore, donвЂ™t need it enabled. Update: For latest information related to basic authentication in Exchange Online, please see Basic Authentication and Exchange Online вЂ“ September 2021 Update.