{
  "id": "CB-M365-MAIL-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-006.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-006",
    "title": "Keep modern authentication enabled for Exchange Online",
    "finding": {
      "title": "Modern authentication is turned off for Exchange Online",
      "description": "Outlook falls back to basic authentication prompts, which bypass multifactor authentication and Conditional Access."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "modern-authentication",
      "oauth",
      "legacy-authentication",
      "outlook"
    ],
    "description": "Modern authentication (OAuth 2.0) is enabled for Exchange Online at organization level\n(`OAuth2ClientProfileEnabled $true`). Outlook for Windows and Mac then sign in through Microsoft\nEntra ID, with multifactor authentication and Conditional Access.\n\nModern authentication is on by default in tenants created after August 2017; the control makes\nsure it was never turned off.\n",
    "rationale": "With modern authentication off, Outlook asks for the password in a basic authentication dialog.\nThose prompts do not support MFA, are easy to imitate and keep legacy protocols in use. Blocking\nlegacy authentication with Conditional Access only works if clients can use modern\nauthentication.\n",
    "impact": "None known on supported clients. Very old Outlook versions (2010, 2013 without the registry keys)\ncannot connect and must be upgraded.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global\n   Reader.\n2. Browse to **Settings** > **Org settings** > **Services** > **Modern authentication** and check\n   that **Turn on modern authentication for Outlook 2013 for Windows and later** is selected.\n3. Or, in Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-OrganizationConfig | Format-List OAuth2ClientProfileEnabled\n   ```\n4. Fail if `OAuth2ClientProfileEnabled` is `False`.\n"
    },
    "remediation": {
      "manual": "1. In the Microsoft 365 admin center, browse to **Settings** > **Org settings** > **Services** >\n   **Modern authentication**, select **Turn on modern authentication for Outlook 2013 for\n   Windows and later** and save.\n2. PowerShell equivalent (Exchange Administrator):\n   ```powershell\n   Set-OrganizationConfig -OAuth2ClientProfileEnabled $true\n   ```\n3. Users may need to restart Outlook to pick up the change.\n"
    },
    "references": [
      {
        "title": "Enable or disable modern authentication for Outlook in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-OrganizationConfig",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-organizationconfig",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester MT.1044",
        "url": "https://maester.dev/docs/tests/MT.1044",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-009",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-011",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}