Office 365 Auth

-->

Client SMTP email submissions (also known as authenticated SMTP submissions) are used in the following scenarios in Office 365 and Microsoft 365:

POP3 and IMAP4 clients. These protocols only allow clients to receive email messages, so they need to use authenticated SMTP to send email messages.
Applications, reporting servers, and multifunction devices that generate and send email messages.

For policies that include an Office 365 resource, if you require authentication for a machine or resource that is part of your Office 365 domain but cannot use MFA, such as a printer, select the Basic Authentication check box. Basic authentication is also called Enhanced Client or Proxy (ECP).

Note

By setting up MFA, you add an extra layer of security to your Microsoft 365 account sign-in. For example, you first specify your password and, when prompted, you also type a dynamically generated verification code provided by an authenticator app or sent to your phone.
In the Microsoft 365 admin center, in the left nav choose Settings Org settings. Under the Services tab, choose Modern authentication, and in the Modern authentication pane, make sure Enable Modern authentication is selected.

As of February 2020, OAuth authentication is available for POP3, IMAP4, and SMTP AUTH connections to Exchange Online. For more information, see Authenticate an IMAP, POP or SMTP connection using OAuth.

The SMTP AUTH protocol is used for client SMTP email submission, typically on TCP port 587. SMTP AUTH supports modern authentication (Modern Auth).

Virtually all modern email clients that connect to Exchange Online mailboxes in Office 365 or Microsoft 365 (for example, Outlook, Outlook on the web, iOS Mail, Outlook for iOS and Android, etc.) don't use SMTP AUTH to send email messages.

Therefore, we highly recommend that you disable SMTP AUTH in your Exchange Online organization, and enable it only for the accounts (that is, mailboxes) that still require it. There are two settings that can help you do this:

An organization-wide setting to disable (or enable) SMTP AUTH.
A per-mailbox setting that overrides the tenant-wide setting.

Note that these settings only apply to mailboxes that are hosted in Exchange Online (Office 365 or Microsoft 365).

Note

If you've enabled security defaults in your organization, SMTP AUTH is already disabled in Exchange Online. For more information, see What are security defaults?.
If your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings outlined in this article. For more information, see Disable Basic authentication in Exchange Online.

Disable SMTP AUTH in your organization

You can only disable (or enable) SMTP AUTH globally for your organization by using Exchange Online PowerShell.

To disable SMTP AUTH globally in your organization, run the following command:

Note: To enable SMTP AUTH if it's already disabled, use the value $false.

How do you know this procedure worked?

To verify that you've globally disabled SMTP AUTH in your organization, run the following command and verify that the value of the SmtpClientAuthenticationDisabled property is True:

Enable SMTP AUTH for specific mailboxes

The per-mailbox setting to enable (or disable) SMTP AUTH is available in the Microsoft 365 admin center or Exchange Online PowerShell.

Use the Microsoft 365 admin center to enable or disable SMTP AUTH on specific mailboxes

Open the Microsoft 365 admin center and go to Users > Active users.
Select the user, and in the flyout that appears, click Mail.
In the Email apps section, click Manage email apps.
Verify the Authenticated SMTP setting: unchecked = disabled, checked = enabled.
When you're finished, click Save changes.

Use Exchange Online PowerShell to enable or disable SMTP AUTH on specific mailboxes

Use the following syntax:

The value $null indicates the setting for the mailbox is controlled by the global setting on the organization. You use the values $true (disabled) or $false (enabled) to override the organization setting. The mailbox setting takes precedence over the organization setting.

This example enables SMTP AUTH for mailbox sean@contoso.com.

This example disables SMTP AUTH for mailbox chris@contoso.com.

Use Exchange Online PowerShell to enable or disable SMTP AUTH on multiple mailboxes

Use a text file to identify the mailboxes. Values that don't contain spaces (for example, alias, email address, or account name) work best. The text file must contain one mailbox on each line like this:

akol@contoso.com
tjohnston@contoso.com
kakers@contoso.com

The syntax uses the following two commands (one to identify the mailboxes, and the other to enable SMTP AUTH for those mailboxes):

This example enables SMTP AUTH for the mailboxes specified in the file C:My DocumentsAllow SMTP AUTH.txt.

Note

To disable SMTP AUTH for the mailboxes, use the value $true. To return control to the organization setting, use the value $null.

How do you know this worked?

To verify that you've enabled or disabled SMTP AUTH for a specific mailbox, do any of the following steps:

Individual mailboxes in the Microsoft 365 admin center: Go to Users > Active users > select the user > click Mail > click Manage email apps and verify the value of Authenticated SMTP (checked = enabled, unchecked = disabled).
Individual mailboxes in Exchange Online PowerShell: Replace <MailboxIdentity> with the name; alias; email address or account name of the mailbox; run the following command; and verify the value of the SmtpClientAuthenticationDisabled property (False = enabled, True = disabled, blank = use organization setting).
All mailboxes where SMTP AUTH is disabled: Run the following command:
All mailboxes where SMTP AUTH is enabled: Run the following command:
All mailboxes where SMTP AUTH is controlled by the organization setting: Run the following command:

The article was updated on February 25, 2021

Due to the Covid-19 pandemic, there was a huge change of plans concerning disabling basic authentication in Microsoft 365 (for connections to Exchange Online). The complete shutdown has been postponed indefinitely. While it gives organizations much more time to prepare, it’s a good idea to get tenants ready before the actual deadline. Continue reading this article to learn more about basic authentication in Microsoft 365, how to block it on your own and when exactly it will be disabled.

Timeline for disabling basic authentication in Office 365

Initially, basic authentication’s demise was scheduled for October 2020. In April 2020, the date was postponed. There was more than one reason for the delay. One of the reasons was Covid-19 and its impact on businesses. Another important factor was that many organizations still actively used basic authentication in their tenants.

As announced on the Exchange Team Blog in February 2021, it turns out that the complete disabling has been rescheduled once again.

The most important dates connected to disabling basic authentication are as follows.

October 22, 2019 – Security Defaults are now turned on by default for all new users. Security Defaults block all legacy authentication protocols.
October 13, 2020 – the initial date for disabling basic authentication in Exchange Online for all tenants. (Postponed)
October 2020 – basic auth will be disabled for tenants which do not effectively use it.
Second half of 2021 – that’s when basic authentication will be disabled for all tenants. More precise date is yet to be announced. (Postponed)
February 2021 – Microsoft announces that basic authentication will not be blocked for now for any protocols that a tenant is using. However, basic auth will be blocked for the unused protocols, with a warning issued 30 days beforehand in the Microsoft 365 Message Center in your tenant.
The complete shutdown of basic authentication for connections to Exchange Online will be announced at least 12 months before it happens. That should be more than enough to tie up all the loose ends.

Rescheduling the end of support date for basic authentication proves that blocking legacy authentication protocol is quite complex. It also means that now it’s more important than ever to know how to disable basic authentication on your own and what are the consequences of doing so. Read on to learn everything about it.

Impact on organization and users

Each and every app, program or service that connects to Microsoft 365, needs to authenticate itself. Once basic authentication is disabled, all applications which use this legacy authentication protocol to access Exchange Online will stop working. You definitely need to take some action if anyone in your company still uses:

Outlook 2010 and older – with basic authentication disabled, those email clients will be unable to connect to Microsoft 365.
Outlook 2013 – enabling OAuth in Outlook 2013 requires some changes to be made in the registry.
Outlook 2011 for Mac – just as in the case of Outlook 2010, it does not support modern authentication.
Remote PowerShell – you will need to use the modern Exchange Online module V2 (learn how to connect remotely to your tenant using this module). If you have any unattended scripts in which you use basic authentication to establish a connection to Exchange Online, they will stop working.
Any third-party app, add-in or mobile email client which doesn’t support modern authentication.

Some tenants may already be qualified for disabling basic authentication. In some cases, IT departments will need to update or upgrade software on multiple workstations.

Download kyohritsu electronic industry usb devices driver. The bottom line is that any Microsoft 365 administrator should prepare for the upcoming changes. If you were never interested in how authentication works, now is the time to take a quick look at some of the key differences between basic and modern authentication.

Basic authentication vs modern authentication

Although the forced switch from basic authentication to more modern security measures might be troublesome, it is a welcome change. Modern authentication, which is based on ADAL (Active Directory Authentication Library) and OAuth 2.0, offers a more secure method of authentication. To put it in simple terms, basic authentication requires each app, service or add-in to pass credentials – login and password – with each request. It means that those applications store users’ or admins’ credentials somewhere in their settings. This opens many possibilities for attackers. What’s more, basic auth doesn’t support scoping or grading permissions, so every app which connects with the basic auth protocol, gains potential access to all data a certain user has access to. In the current day and age, the best security and privacy-related practice is to allow access only to data and resources required for an application to work, nothing more. The impact will be even greater if a leaked password is used in other places as well.

Modern authentication doesn’t let apps save Microsoft 365 account credentials. In order for an app/service/client to be authenticated, a user needs to log in to their account using the standard Microsoft 365 login experience and accept an app’s request to access their account. Access is granted thanks to tokens, which have a set lifetime. Tokens give a strictly defined permission scope, which needs to be accepted by the signed in user. Finally, modern authentication enables the use of multi-factor authentication (MFA), which adds yet another security layer to your tenant.

Your organization may not need to continue using basic authentication. To make sure, you need to find out which applications are used to sign in to your tenant. You can use Azure Active Directory for that purpose.

Checking applications which sign in to Azure AD

You can check sign-ins to your Microsoft 365 tenant in the Azure Active Directory admin center by going to Azure Active Directory > Monitoring > Sign-ins (or by using this link). The Sign-ins page allows you to check which applications are used to connect to your Microsoft 365 organization, who connects, where from, and much more:

When you click any record, you will be able to learn more about the sign-in attempt. It includes information about the device used to sign in and authentication details.

How to disable basic authentication in Office 365

There is more than one way to block basic authentication in Office 365 (Microsoft 365). For example, you can use:

Security Defaults – turned on by default for all new tenants. This set of security-related settings disables all legacy authentication methods, including basic auth and app passwords. Enabling security defaults might influence some third-party applications you use with your Microsoft 365 tenant.
Client Access Rules – covered in detail in this article. Client Access Rules allow you to create a very specific rules to allow basic auth in very specific cases. You can, for example, allow basic auth for a certain AD group or IP range used in your HQ.
Authentication policies – a tool dedicated to blocking basic auth. You can control those policies using PowerShell (Set-AuthenticationPolicy) or the Microsoft 365 admin center. Since the tool is dedicated to blocking basic authentication, I’ll describe some general principles on how to use it below.

To configure authentication policies, go to the Microsoft 365 admin center > Settings > Org settings > Modern authentication or use this link.

In this window, you can choose which protocols should be able to use basic authentication to access your tenant. You can, for example, uncheck Exchange Online PowerShell to make it impossible to use this legacy authentication method to start a remote PowerShell Session to Exchange Online. There is a catch, though. It takes 24 hours for the changes made in this panel to kick in. You can force changes, but it requires using PowerShell.

When I run the Get-AuthenticationPolicy cmdlet, I can see that the changes have already been applied:

Which is ironic, because I’ve used the basic auth method to connect to Exchange Online via PowerShell in the first place. Beijing tianyu communication equipment modems driver download.

To force-apply Authentication Policies changes for a single account (in the example below, it will apply them to admin), you can run the following cmdlet:

To apply changes to all mailboxes, run the following code:

Office 365 Authentication Methods

After doing so, if you used the basic auth method to start a remote PowerShell session, trying to run any Exchange Online cmdlet should make the login pop-up window to appear:

Now, even if you insert correct credentials, the PowerShell console should display the access denied message:

Since the logon attempt wasn’t successful, it will not appear on the Microsoft Azure Sign-ins page.

Basic authentication in Office 365 vs CodeTwo software

Here at CodeTwo, we believe that security should always be a priority. That’s why all our solutions for Microsoft 365 support modern authentication. So, if you’re using our tools for email signature management, backup or migration purposes, you can rest assured that when basic authentication is disabled, they will continue to work without issues. And if you don’t know our products, take a look below for a quick overview:

Office 365 Authenticator App Qr Code

CodeTwo Email Signatures for Office 365 – lets you manage email signatures in your Microsoft 365 organization. In just a few moments, you can design and deploy rules which add professionally branded email signatures for emails sent from any email client and device.
CodeTwo Backup for Office 365 – secures your Microsoft 365 organization by creating a continuous backup of your organization’s emails, documents and other resources. Backed-up data can later be quickly discovered and restored to its original location or the location of your choice.
CodeTwo Office 365 Migration – lets you easily and securely migrate data between Microsoft 365 tenants, or from on-premises Exchange to Microsoft 365. You can simplify your migration process and let the tool handle most of the work.
CodeTwo User Photos for Office 365 – a freeware tool which lets you manage user photos in Microsoft 365. The tool allows you to quickly and easily import and export profile pictures for all users, without the need to use any scripts. Those photos are displayed in Microsoft 365 settings, Outlook, Teams, Outlook on the web, and more.

Enable Smtp Auth Office 365

If you are using CodeTwo Backup for Office 365 or CodeTwo Office 365 Migration, make sure to update it to the latest version. This way, you will get the most secure and reliable experience.