Hi Team. I have a doubt, I have assign MFA for Outlook and Teams clients? In Conditional Access policy, Conditions - Device platforms - Select Windows.In Client Apps select Mobile apps and desktop clients. This option, apply for Outlook and Teams clients? Or exist other option for configure MFA in this clients? Regards, Thanks,

Hi CarlosMorales , This is what I would do. Make sure you use Modern authentication.This is not ideal situation with Exchange Online App, but adding Device platfrom - Windows, Client apps - Mobile apps and Desktop clients plus enabling Modern authentication is the closest you can get.I just tested in my environment and it will require MFA for Outlook client on Windows (if modern enabled), it does not ask you for MFA on other devices. It will not require MFA in browsers. Good luck Please see below, testing environment with the policy from above.

Hi mikhailf , Thanks for the contribution. That is the main reason I excluded Browser. I just update behavior from the test environment.

Hi mikhailf ,see below logging into web Outlook. No MFA.

Hi CarlosMorales ,thanks for the reply. Keep in mind that in this particular setup, you have to disable Legacy authentication and enable Modern authentication. You can accomplish this by additional additional Conditional Access. see below. Also you can do this by disabling Basic authentication from Admin center.

Hi CarlosMorales , you can uncheck everything but I would suggest also creating a CA policy and block legacy. If you decide to uncheck from Admin portal - see below my environment. If you decide to do CA policy, you can Assign to test user, Cloud apps to All Cloud Apps, and Conditions under Client apps set to Yes, and check both under Legacy authentication clients. Under Grant set to Block. Good luck. Make sure your Outlook client is the latest version to support Modern authentication. You can read about it here - Modern Authentication configuration requirements for transition - Exchange | Microsoft Docs

Create Conditional Access Policy | Microsoft Community Hub

16 Replies

mikhailf
Iron Contributor
May 01, 2022
Hello Carlos,
As far as I know, Office 365 Exchange Online is NOT Outlook Client.
It is related to access to Outlook via a web browser (Chrome, Edge, etc.).
https://techcommunity.microsoft.com/t5/outlook-blog/conditional-access-in-outlook-on-the-web-for-exchange-online/ba-p/267069
- CarlosMorales
  Brass Contributor
  May 01, 2022
  Hi Mikhalif.
  This is correct, with Exchange Online policy does not work. I remove Exchange Online and select Office 365 but the policy does not working with Outlook client only working with Teams Client.
- Adin_Calkic
  Iron Contributor
  May 01, 2022
  Hi mikhailf ,
  
  Thanks for the contribution. That is the main reason I excluded Browser. I just update behavior from the test environment.
  - mikhailf
    Iron Contributor
    May 01, 2022
    So please, check the rahuljindal-MVP comment.
    It makes sense to check the What If feature and Azure AD Sign-in logs.
    In addition to that, have you tried to log in to Outlook web using web browser? I wonder if you get an MFA there.
rahuljindal
Bronze Contributor
Apr 29, 2022
Hi. It sounds about right. Is the CA policy not working for you?
- CarlosMorales
  Brass Contributor
  Apr 30, 2022
  It only works in Teams client. In Outlook client not working.
  - rahuljindal
    Bronze Contributor
    Apr 30, 2022
    Have you tried running your scenario against the whatif tool? Also, you can look at sign-in logs to verify if you have configured the right CA parameters or not.

Forum Discussion

Create Conditional Access Policy

16 Replies

Resources