cirsec Baselines
Esc
Microsoft 365 tenant · Exchange Online, Defender for Office 365 & mail DNS

Keep modern authentication enabled for Exchange Online

When it fails: Modern authentication is turned off for Exchange Online. Outlook falls back to basic authentication prompts, which bypass multifactor authentication and Conditional Access.

CB-M365-MAIL-006highactivemanualprofile baseline

Description

Modern authentication (OAuth 2.0) is enabled for Exchange Online at organization level (OAuth2ClientProfileEnabled $true). Outlook for Windows and Mac then sign in through Microsoft Entra ID, with multifactor authentication and Conditional Access.

Modern authentication is on by default in tenants created after August 2017; the control makes sure it was never turned off.

Rationale

With modern authentication off, Outlook asks for the password in a basic authentication dialog. Those prompts do not support MFA, are easy to imitate and keep legacy protocols in use. Blocking legacy authentication with Conditional Access only works if clients can use modern authentication.

Impact

None known on supported clients. Very old Outlook versions (2010, 2013 without the registry keys) cannot connect and must be upgraded.

Audit

  1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global Reader.
  2. Browse to Settings > Org settings > Services > Modern authentication and check that Turn on modern authentication for Outlook 2013 for Windows and later is selected.
  3. Or, in Exchange Online PowerShell (read-only): 
    Get-OrganizationConfig | Format-List OAuth2ClientProfileEnabled
  4. Fail if OAuth2ClientProfileEnabled is False.

Remediation

  1. In the Microsoft 365 admin center, browse to Settings > Org settings > Services > Modern authentication, select Turn on modern authentication for Outlook 2013 for Windows and later and save.
  2. PowerShell equivalent (Exchange Administrator): 
    Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
  3. Users may need to restart Outlook to pick up the change.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1IA-2related
NIST SP 800-53 Rev. 55.1.1IA-2(1)related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1110.003
MITRE ATT&CKT1078.004
  • related CB-M365-MAIL-009 Disable SMTP AUTH client submission for the organization
  • related CB-M365-MAIL-011 Disable Exchange Web Services, or restrict it to approved applications
  • related CB-M365-AUTH-001 Block legacy authentication with Conditional Access

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr