Forum Discussion
Exchange Server 2016 On-Premise and 2FA/MFA
Hi I am trying to find some specific info with regards to Exchange Server 2016 on-premise implementation and 2FA/MFA and not finding much luck. I have a client who is looking to implement a 2...
Hello dhillank,
For securing OWA and ECP please take a look at my blog:
https://www.patrickvanbemmelen.nl/securing-using-sso-for-owa-ecp-with-the-azure-app-proxy/
You can even implement SSO in there!
For EWS, does the company really need it?
If not, then you could block it or look at other solutions like Azure AD applications to give permissions to external applications.
It's really best practice to disable ActiveSync as it runs on basic authentication which isn't the best security method nowadays.
The Outlook Mobile App does support OAuth and if you setup Hybrid Modern Authentication (https://docs.microsoft.com/en-us/exchange/clients/outlook-for-ios-and-android/use-hybrid-modern-auth?view=exchserver-2019) and disable legacy protocols like basic authentication then you have the best security posture possible for an on-premise Exchange Server.
For securing OWA and ECP please take a look at my blog:
https://www.patrickvanbemmelen.nl/securing-using-sso-for-owa-ecp-with-the-azure-app-proxy/
You can even implement SSO in there!
For EWS, does the company really need it?
If not, then you could block it or look at other solutions like Azure AD applications to give permissions to external applications.
It's really best practice to disable ActiveSync as it runs on basic authentication which isn't the best security method nowadays.
The Outlook Mobile App does support OAuth and if you setup Hybrid Modern Authentication (https://docs.microsoft.com/en-us/exchange/clients/outlook-for-ios-and-android/use-hybrid-modern-auth?view=exchserver-2019) and disable legacy protocols like basic authentication then you have the best security posture possible for an on-premise Exchange Server.