Blog Post

Exchange Team Blog
2 MIN READ

Exchange Server AD FS Modern Authentication: Expanded Outlook client support

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Sep 08, 2026

We are pleased to announce expanded Outlook client support for Exchange Server AD FS Modern Authentication.

In our previous update, we announced broad Outlook for Windows/Mac support and support for the native Mail app on iOS and macOS. We are now extending this support to Outlook for iOS and Outlook for Android.

Outlook for iOS and Outlook for Android can now use AD FS Modern Authentication to access mailboxes in supported pure on-premises Exchange Server deployments.

Deployment context: AD FS Modern Authentication is intended for pure on-premises Exchange organizations that don't use Microsoft Entra ID or an Exchange hybrid configuration. Exchange hybrid organizations should continue to use Hybrid Modern Authentication (HMA) with Microsoft Entra ID.

Supported clients at a glance

Client

Supported release or OS

Administrator action

Outlook for Windows

Supported Microsoft 365 Apps channels and supported perpetual releases; Windows 11 22H2 or later

Install the required Windows update, trust the AD FS service URLs, and enable Exchange on-premises Modern Auth in Outlook.

Outlook for Mac

Outlook for Mac in Microsoft 365, build 16.106 or later; macOS Sequoia or later

Use Exchange Server Subscription Edition with the December 2025 or later Security Update, and configure ADFSAuthorizedURLs.

Outlook for iOS

Latest supported Outlook and iOS versions

Follow the Exchange and AD FS configuration guidance.

Outlook for Android

Latest supported Outlook and Android versions

Follow the Exchange and AD FS configuration guidance.

Native Mail app for iOS and macOS

iOS 17.6.1 or later; macOS Sequoia or later

Configure the documented native client application and permissions in the AD FS Outlook application group.

Updated documentation

We have updated the deployment documentation to make the supported-client requirements easier to review:

  • A new summary brings all supported clients and operating-system requirements together.
  • Outlook for Windows build, Windows update, registry, and AD FS trusted-domain requirements are grouped under the Windows client.
  • Outlook for Mac requirements include the ADFSAuthorizedURLs Terminal configuration, a multiple-namespace example, and the equivalent Mobile Device Management settings.

Learn more

For complete prerequisites and configuration steps, see Enable Modern Auth in Exchange Server on-premises.

For background on the earlier client expansion, see Update on Exchange Server ADFS Modern Authentication support.

The Exchange Server Team

Published Sep 08, 2026
Version 1.0
administration
announcements
exchange
exchange 2019
exchange se
hybrid
outlook
security

4 Comments

  • saadouache's avatar
    saadouache
    Copper Contributor
    Sep 22, 2026

    We tested this against a pure on-premises Exchange Server SE deployment with AD FS as the STS, no Entra ID, no directory synchronisation and no hybrid configuration, and wanted to share the result in case it is useful to others.

     

    Outlook for iOS and Outlook for Android both authenticate successfully through AD FS, including multi-factor authentication. AD FS issues tokens with a Success result and logs no errors. Neither client then contacts Exchange again. No ActiveSync request is ever made, and the app returns to the Add Account screen without displaying any error.

     

    The two clients fail in different places, which we think is the useful detail:

    - Outlook for iOS requests a token only for the autodiscover resource, and never for the mailbox resource.

    - Outlook for Android does request and receive a valid mailbox token with MFA performed, and still makes no ActiveSync request.

     

    So the cause does not appear to be token issuance or relying-party configuration.

     

    Controls on the same server and the same day: classic Outlook for Windows opens a live mailbox over MAPI/HTTP, and the native iOS Mail app runs a live ActiveSync session using a mailbox token from the same AD FS, on the same iPhone, about 80 seconds after Outlook for iOS failed. Our AD FS application group, redirect URIs and all twelve scopes match the documentation exactly, including the "Update the existing ADFS Outlook Application Group" section.

     

    One documentation question: the supported clients table lists Outlook for iOS and Android as supported, while the "Effect on other clients" table in the same article still states that both fall back to Basic auth. Could those two be reconciled?

     

    We have opened support case 2609220050003524 with the full AD FS and IIS logs, a screen recording of the client, and a frame-by-frame correlation between the two. Happy to provide test environment access if it would help reproduce this.

    • derSchweiger's avatar
      derSchweiger
      Brass Contributor
      Sep 22, 2026

      Thanks for sharing. Would be great if you could keep us posted since we also consider this for our customers. 

  • Ioannis Psychogios's avatar
    Ioannis Psychogios
    Copper Contributor
    Sep 12, 2026

    This update is a massive win for pure on-premises environments. For a long time, managing strict security policies or MFA requirements on mobile devices without relying on Exchange Online or Hybrid Modern Authentication (HMA) felt like an uphill battle. Bringing native OAuth and AD FS support directly to Outlook for iOS and Android removes one of the last major roadblocks for organizations locked into an on-premises footprint due to regulatory or architectural constraints.

    It also ties things together nicely alongside the existing desktop and native mobile mail client support, finally giving end-users a seamless, uniform login experience across all their devices instead of having to work around legacy authentication limitations or third-party client workarounds.

  • derSchweiger's avatar
    derSchweiger
    Brass Contributor
    Sep 10, 2026

    Great step into the right direction to secure and support On-Premises infrastructures! Hopefully, we will see more features like this in the future.