Hi !
We have an AD Forest with Exchange 2019 containing multiple MBX and CAS Server with multiple DAG as a Hosted Exchange for our customers.
We want to enable 2FA on one of our client's hosted domains.
Apparently we can activate it on all CAS for all mailboxes but not only for some.
We have tested activating 2FA with ADFS on two CAS servers and it works. Now we want to restrict users using 2FA to only use these two CASs and block access on CASs that do not have 2FA enabled. Because otherwise it is possible to log in via the other CASs on their mailboxes.
Does anyone have a solution to do this?
I tried to do it with Exchange 2019 new-clientaccessrule commands but it is not possible with Exchange 2019 On Premise servers, some parameters like ExceptAnyOfAuthenticationTypes are not available.
We also considered doing:
- A second Exchange organization in the same forest (this is not possible).- A second forest with other Exchange servers (new organization) but this involves a lot of servers in our case.
Thanks for your advice and help!
