Forum Discussion
MFA and desktop apps
VasilMichev Hey Vasil,
Thanks for the feedback. After some testing I'm a little fuzzy on MFA. I figure it should be straight-forward, but seems to react differently for the various non-browser logins.
If I enable a user for MFA, what is required for the Office desktop apps to be able to connect successfully.
As mentioned in the previous post, with MFA turned on for the test user, I was prompted for an SMS code when logging into Word and Excel. When I tried to setup Outlook, and OneDrive I received a message that the account setup could not be completed.
I decided to disable the MFA, to see what would happen, and I was able to set up the Outlook account on the device.
Now I want to enable MFA again, to see what occurs, but when I do, I'm still able to login without a 2nd authentication. Do I have to 'enforce' the MFA to reactivate it for the user?
If I select enforce, I get the following message:
So, does this mean that for Outlook and OneDrive apps, I need an app password with MFA enabled? And what does the note about admins refer to?
Thanks
As mentioned above, enabling OAuth/MFA does not disable the "legacy" authentication methods. If you want to disable those, you can use CA policies, Exchange auth policies or security defaults.
Both Outlook and OneDrive support MFA just fine, but you need to make sure you're using a proper version. Everything from the past few years will do, Office in particular added support in 2013 SP2. Apart from that, you need to make sure OAuth is enabled service-side, which for Exchange is done via PowerShell (although most tenants should have it already enabled).
Lastly, app passwords are not needed. They are a legacy "workaround" for scenarios where the client apps didnt support MFA, this is no longer the case for any Microsoft app.
