Basic Authentication Deprecation in Exchange Online – May 2022 Update

Hi All

Need some help here. Tried reaching out to M365 support and I reckon they are providing conflicting statements.

Here's our situation:

- At present we have a Hybrid Exchange Setup with Exchange Online

- We want to enable Hybrid Modern Authentication next month

- We do have some legacy apps in our on-premises environment that cannot do Modern Authentication or have support to configure OAuth using MSAL

- We know that enabling Hybrid Modern Authentication does not disable Basic Authentication on our on-premises Servers.

- We know that Microsoft is disabling Basic Authentication from October 2022. We want to understand the impact of Microsoft Disabling Basic Authentication on Hybrid Modern Authentication from Oct 2022.

We want to understand the impact of Microsoft Disabling Basic Authentication on Hybrid Modern Authentication from Oct 2022.

We have some legacy apps authenticating with our on-premises Exchange server using Basic Authentication and we will keep it that way.

If we turned ON Hybrid Modern Authentication (HMA) in our environment

• Does this mean - from Oct 2022 - our Legacy apps that can only do Basic Authentication using POP/IMAP will be unable to authenticate if we turned ON Hybrid Modern Authentication?

I have gone through Microsoft's doco on HMA and it states that if application cannot do Modern Authentication, then authentication fails back to Basic Authentication.

- But what about HMA after Oct 2022, once Microsoft permanently disabled Basic Auth on POP/IMAP?

- In HMA, will the legacy app continue to authenticate with Basic Auth against the on-premises Exchange Server or will auth fail due to HMA nd auth provider being Microsoft (evoSTS)?

Apologies if the post is too long, but really need to understand the impact.

Response from M365 Support below: