Microsoft will disable Basic Auth in Exchange Online in October 2022

guest · Sep 26, 2021

Microsoft will disable Basic Auth in Exchange Online in October 2022
November 26, 2021
https://www.bleepingcomputer.com/ne...asic-auth-in-exchange-online-in-october-2022/

Microsoft announced that Basic Authentication will be turned off for all protocols in all tenants starting October 1st, 2022, to protect millions of Exchange Online users.

This announcement comes after the company postponed the removal of Basic Authentication from Exchange Online until the second half of 2021 because of the COVID-19 pandemic.

"Today, we are announcing that, effective October 1, 2022, we will begin to permanently disable Basic Auth in all tenants, regardless of usage (with the exception of SMTP Auth, which can still be re-enabled after that)," the Exchange Online Team said earlier this week.
Microsoft already began disabling basic auth in June for tenants who weren't using it and also explained how customers could re-enable protocols inadvertently affected.
Click to expand...

Amit Serper, Guardicore's AVP of Security Research who authored the report, also disclosed an attack called the 'The ol' switcheroo' that forces an Exchange client to negotiate in basic authentication.

While it dramatically simplifies the authentication process, basic auth also makes it easier for attackers to steal the credentials when the connections are not secured using the Transport Layer Security (TLS) cryptographic protocol.
Click to expand...

guest · Sep 3, 2022

Microsoft will disable Exchange Online basic auth next month
By Sergiu Gatlan @serghei - September 1, 2022

Microsoft warned customers today that it will finally disable basic authentication in random tenants worldwide to improve Exchange Online security starting October 1, 2022.

Today's announcement follows multiple reminders and warnings the company has issued over the last three years, the first published in September 2019.
Click to expand...

The company again asked customers to toggle off basic auth in September 2021 and May 2022 after seeing that many of them were yet to move their clients and apps to Modern Authentication.

"Since our first announcement nearly three years ago, we've seen millions of users move away from basic auth, and we've disabled it in millions of tenants to proactively protect them. We're not done yet though, and unfortunately usage isn't yet at zero. Despite that, we will start to turn off basic auth for several protocols for tenants not previously disabled," the Exchange Team said today.

"Starting October 1st, we will start to randomly select tenants and disable basic authentication access for MAPI, RPC, Offline Address Book (OAB), Exchange Web Services (EWS), POP, IMAP, Exchange ActiveSync (EAS), and Remote PowerShell."
Click to expand...

Microsoft: Basic Authentication Deprecation in Exchange Online – September 2022 Update

One month from today, we’re going to start to turn off basic auth for specific protocols in Exchange Online for customers who use them.
Click to expand...

Log in or Sign up

Microsoft will disable Basic Auth in Exchange Online in October 2022

guest Guest

guest Guest

Log in or Sign up

Microsoft will disable Basic Auth in Exchange Online in October 2022

guest Guest

guest Guest

Useful Searches