Exchange Server 2016 On-Premise and 2FA/MFA

[dhillank]

Hi

I am trying to find some specific info with regards to Exchange Server 2016 on-premise implementation and 2FA/MFA and not finding much luck.

I have a client who is looking to implement a 2FA solution for their on-premise exchange environment. They currently have PingFederate in the environment and are implementing Symantec 2FA as the MFA provider.

From my understanding I believe that we can implement 2FA without any problems for OWA but I have also been asked to investigate the implementation of 2FA for EWS, ActiveSync and the Outlook Mobile app.  This is where I cannot find information. 

Is it possible to implement 2FA for these services? Please advise

[#2]

Hello @dhillank,

For securing OWA and ECP please take a look at my blog:

https://www.patrickvanbemmelen.nl/securing-using-sso-for-owa-ecp-with-the-azure-app-proxy/

You can even implement SSO in there!

For EWS, does the company really need it?
If not, then you could block it or look at other solutions like Azure AD applications to give permissions to external applications.
It's really best practice to disable ActiveSync as it runs on basic authentication which isn't the best security method nowadays.
The Outlook Mobile App does support OAuth and if you setup Hybrid Modern Authentication (https://docs.microsoft.com/en-us/exchange/clients/outlook-for-ios-and-android/use-hybrid-modern-auth...) and disable legacy protocols like basic authentication then you have the best security posture possible for an on-premise Exchange Server.