Forum Discussion
Block legacy auth in Exchange Online
I'd love to disable basic auth in my org as we've had instances where a mailbox has become compromised using a basic auth attack, but as a 60k user base, we have a lot of legacy kit out there which just doesn't support modern auth.
Most users use Android too - and while we've explained they have the Outlook for Android app available some do prefer to use the native Android client.
One thing I was curious on though, using the article referenced in the announcement today, is that any different to disabling basic auth apps via a conditional access policy? As that would allow us to give the helpdesk staff targeted groups of users who we can disable for basic auth.
It is different from CA, the feature works by blocking the request at the Exchange server layer, even before redirecting to the auth provider.
Thanks for confirming
Am I right in thinking the end result would be the same though? Basic auth'd blocked using CA would be the same as blocking it on EXO?
Yup, but one of the benefits you get from this method, apart from the greater granularity, is that blocked/failed (or god forbid successful) logins will not trigger the lockout windows, as the request never reaches Azure AD. With CA policies, the block happens after authentication, at that point the account is compromised.
