SfB Server Now Supports Blocking NTLM Externally

We used this to disable basic auth externally a few weeks ago in SfB Server 2015.  I noticed that FBA login on the dial in PIN page still works externally, outside of modern auth.  According to the documentation, this should be disabled.  Has anyone else tested?  Is there a step missing in the documentation?

Hi David, FBA login should definitely not be working.  Can you open a support case for this with logs, etc.  so that we can investigate?

I have, thank you.  I was hoping to see if it was something unique with my environment or a bug.  My suspicion is there a step missing in the documentation.  I'm sure we will get it working!

I just discovered that BlockWindowsAuthExternally also disables the ability for both internal and external users to sign in to the Skype Meetings App.  The link to sign in is gone in both scenarios.

We tried disabling NTLM Externally by using Scenario BlockWindowsAuthExternally. But this results in all our internal clients not being able to login anymore.

NOTE: we are using skype in a resource forest, so users login with forest A accounts on their clients, their Skype accounts reside in forest B with the OriginatorSid set to the SID of the account in Forest A.

If I test a login internally with an account of Forest B directly, login does work. So at first sight it looks like Skype is treating users from the different forest as external.

Hi Tom, 

This should work. Can you please open a support ticket so that we can investigate properly?  And please include the client signin logs.  Thanks.

Update: We did find a real bug with Forms Based Auth not being blocked when you blocked Window Auth externally. The fix for this will be in a upcoming CU for SfB server.  ETA for this release is Calendar year 2019 Q3. 

Hi, I turned off NTLM for external users using BlockWindowsAuthExternally. Internal users can still connect. However, none of the external users can connect via Skype for Business client.

This looks like I missed a step. Should modern authentication have kicked in automatically or is that a separate procedure that needs to be setup prior to disabling NTLM for external users ?

sengstar2005 , You have to enable Modern Auth separately. It does not automatically kick in when you disable NTLM. They are two separate procedures.

Here are some useful links.  The exact instructions will depend on what topology you have.

SfB and Modern Auth Supported Topologies: https://technet.microsoft.com/en-us/library/mt803262.aspx

Instructions to Deploy Modern Auth : https://aka.ms/ModernAuthOverview

MA with SfB Onprem and AAD: https://techcommunity.microsoft.com/t5/Skype-for-Business-Blog/Modern-Auth-for-SfB-OnPrem-with-AAD/ba-p/180910

OK, thanks Natasha. That explains it.