We wanted to let you know about the next chapter in our retirement of basic authentication in Exchange Online.

Last month we turned off Basic auth in Exchange Online for many customers. We’ve protected millions of users from the risks associated with using this legacy form of authentication to access their data.

We want to thank you, too, for all the hard work you’ve done to prepare your tenant and users for this change, and for your part in helping secure our service and your data.

What’s Next

With the protocols most at risk on their way to being secured, we are now turning our attention to one important Exchange protocol that remains untouched by this effort – Autodiscover. The Autodiscover service which is used by Outlook, Exchange ActiveSync, and other Exchange Web Services clients and custom code for service location discovery.

Once Basic auth for Outlook, Exchange ActiveSync and Exchange Web Services has been permanently disabled in your tenant, there’s really no reason to keep Autodiscover enabled for Basic auth. So, we’re turning off Autodiscover next. You can of course do this yourself today, using an Authentication Policy (and we recommend you do).

Remember, as with all the other protocols, we’re not turning off the protocol itself, only the ability to authenticate over the protocol using nothing more than a username and password.

Timing

We’re starting right away with the tenants with no Basic auth usage at all in 2022, and then in early 2023 (as Basic auth for related protocols is permanently disabled), we will move on to everybody else. If you re-enabled Basic auth in your tenant, or took the option to request more time, we’ll turn off Basic auth for Autodiscover after that extension expires. It’s going to take a few weeks to roll this change out. No tenant will be excluded.

We’re not going to update the self-service diagnostic to allow you to re-enable Autodiscover, which is why we will not disable Autodiscover for any tenant with usage this year. On December 31, 2022, the self-service diagnostic will go away, and after that it won’t be possible to re-enable anything.

With this last step in the process, we will be helping further secure our customers’ accounts and data. Thank you for your help and understanding throughout this process.

The Exchange Team

Last month we turned off Basic auth in Exchange Online for many customers. We’ve protected millions of users from the risks associated with using this legacy form of authentication to access their data.

We want to thank you, too, for all the hard work you’ve done to prepare your tenant and users for this change, and for your part in helping secure our service and your data.

What’s Next

With the protocols most at risk on their way to being secured, we are now turning our attention to one important Exchange protocol that remains untouched by this effort – Autodiscover. The Autodiscover service which is used by Outlook, Exchange ActiveSync, and other Exchange Web Services clients and custom code for service location discovery.

Once Basic auth for Outlook, Exchange ActiveSync and Exchange Web Services has been permanently disabled in your tenant, there’s really no reason to keep Autodiscover enabled for Basic auth. So, we’re turning off Autodiscover next. You can of course do this yourself today, using an Authentication Policy (and we recommend you do).

Remember, as with all the other protocols, we’re not turning off the protocol itself, only the ability to authenticate over the protocol using nothing more than a username and password.

Timing

We’re starting right away with the tenants with no Basic auth usage at all in 2022, and then in early 2023 (as Basic auth for related protocols is permanently disabled), we will move on to everybody else. If you re-enabled Basic auth in your tenant, or took the option to request more time, we’ll turn off Basic auth for Autodiscover after that extension expires. It’s going to take a few weeks to roll this change out. No tenant will be excluded.

We’re not going to update the self-service diagnostic to allow you to re-enable Autodiscover, which is why we will not disable Autodiscover for any tenant with usage this year. On December 31, 2022, the self-service diagnostic will go away, and after that it won’t be possible to re-enable anything.

With this last step in the process, we will be helping further secure our customers’ accounts and data. Thank you for your help and understanding throughout this process.

The Exchange Team

We wanted to let you know about the next chapter in our retirement of basic authentication in Exchange Online.

RyanM - top marks for spotting that, you win the prize. SMTP is bit 9, Autodiscover is bit 10. We're not setting bit 9 yet. ReportingWebServices is bit 11, but we're blocking that at the service level very soon, so all tenants will be blocked, regardless of us setting the bit. 

Greg Taylor - EXCHANGEDid the value of BasicAuthBlockedApps (retrieved via Get-OrganizationConfig) change recently? It appears to have gone from 8 bits to 10 bits. The value in my tenant went from 255 (11111111) to 767 (1011111111). Can you share what protocols the additional bits map to (Autodiscover & ReportingWebServices perhaps)?

Also tagging EXPTA since I'm pretty sure he wrote the blog post that helps explain this value:

https://blog.expta.com/2021/10/notes-and-details-on-eradication-of.html

We still do not have any published date of when basic auth would be disabled for SMTP.

Note that even if we are not doing it, you really should do it for all mailboxes except those that explicitly need it, because SMTP is the most attacked protocol.

What about SMTP? What are the chances of it being turned off? Are there any plans yet?

Codepoet80 Can the old tablets not install a modern browser app and use Web Outlook? Surely this is an option

SMTP is not being disabled yet. My guess is it'll only be disabled in a year's time.

Petri-X An easy way to see which accounts are using Basic Auth is to go to Azure AD, users, sign-in logs, add filter, select 'client app', then tick all of the Legacy Authentication Clients, leaving the two Modern Authentication Clients unticked.

Brent-H - Not sure that statement about its use is accurate. But we'll sort that too rest assured. 

Ah yes, \"we looked for customers that don't use it\"; That's why I had spent the last few weeks searching for a solution for you breaking our email.

Thanks for making us jump through hoops just to be able to work. 
Really nice job you did there.

There's one other protocol for basic auth that doesn't seem to be mentioned yet: \"Outlook Service\", which according to the Authentication policy table is/was used by the Windows 10 Mail app. I've already blocked basic auth for it along with the others with an authentication policy (I didn't see any usage of \"Universal Outlook\" in the Azure sign-in logs), but if basic auth for it remains enabled by default, wouldn't that become another possible target for attacks?

Codepoet80 - I'm sorry you feel like that, we do care, or we wouldn't be trying to help protect your tenant, but I do understand how it might feel. All the best. 

Jo_Bowles - Sorry to hear you got compromised, glad we could help you out though. 

JonasBack - SMTP is already under attack. Constantly. Given we can't turn it off yet because of all those hardware devices out there my advice is simply this: Disable SMTP Client Auth Submission at the tenant level, and re-enable on a per-user basis. If you can block Basic for SMTP too, great, but that's often not possible. https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission