MFA - Outlook 2010 (App Password or Basic Credential)

[Fraser MacFarlane]

Hi all,

Apologies if this has already been discussed at length. Trying to establish the correct behaviour when Azure AD Account has MFA enabled and the user is using Outlook 2010 to access their Exchange Online mailbox. I know 2010 doesn't support Modern Auth, but unfortunately our Office refresh program is somewhat behind and we have a pressing need to enable MFA to combat some recent malicious activity.  

So far our experience is that a user with Outlook 2010 can authenticate using current Azure AD credentials whereas our expectation is that current Azure AD credentials would fail in favour of an App Password. 

I am hoping that our experience to date is not the expected behaviour. 

[#2]

MFA enabled is different from MFA enforced, the latter one meaning that the user will have to go over the MFA challenge every time he access an O365 resource. If they are simply "enabled", they need to go over the setup process first (part of which is creating an app password). You can also force MFA via Conditional access for just specific apps.

There's a more detailed explanation here: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates#enable-a...