We are announcing the deprecation of Exchange ActiveSync (EAS) certificate-based authentication (CBA) directly to Exchange Online. By the end of 2026, Microsoft will no longer support direct CBA conn...
Published May 08, 2026
Version 1.0
Blog Post
6 MIN READ
Retirement of Direct Exchange ActiveSync Certificate-Based Authentication by End of 2026
Hi!
Thank your for the great article.
What about organizations that still uses hybrid Exchange with federated accounts using CBA with ADFS, how are they affected on this?
It would be really nice if the article could contain information about this scenario also.
Have tested by changing to the new CBA endpoint “outlook-cba.office365.com” together with OAuth protocol in Intune,
but the audit signing logs still show “Exchange Active Sync validity check”. The Entra ID CBA authentication method would perhaps has no effect as the CBA authentication method is routed via ADFS?
It would be nice if this article could include this scenario, so that it is possible to migrate and be ready before EOL.
Thanks!
- Greg Taylor - EXCHANGE
Microsoft
Anders Horgen I've been trying to send a message on this platform but it just keeps failing.
firstly, sorry for the super slow response to your question. I didn't get any notification. Can you help me understand the flow a bit better? The CBA you are doing is against ADFS on-prem? In which case, all EXO sees is an Entra token - that's not direct CBA to EXO.... but maybe I'm missing something.
Feel free to reply here, or just email me at grtaylor at you know the domain I'm sure.
Thanks
Greg
