MFA and desktop apps

[mikbai]

Hello, 

I'm playing around with MFA. I've enabled it on one user to test things out. When logging into the web portal, there are no issues. I receive a prompt to enter an text code and all is good. When i try to set up either Outlook or OneDrive desktop apps, I receive an error that the account couldn't be set up. Yet if I log into Word or Excel, no issues, I have to enter a code that is texted.

Upon further investigation, it looks like I have to set up modern authentication on the tenant, in order for  the Outlook  and SharePoint service to work. I would like to test this out. If I enable modern auth for the tenant will it impact all my users, or only the ones that have MFA enabled?

Thanks

[#2]

Define "impact", as you've seen it does have an impact on the way people log in. But generally speaking, enabling this just makes another auth method possible, it doesnt prevent people from using legacy methods, unless you specifically decide to block them (or you have security defaults enabled).

[#3]

@VasilMichev Hey Vasil, 

Thanks for the feedback. After some testing I'm a little fuzzy on MFA. I figure it should be straight-forward, but seems to react differently for the various non-browser logins.

If I enable a user for MFA, what is required for the Office desktop apps to be able to connect successfully.

As mentioned in the previous post, with MFA turned on for the test user, I was prompted for an SMS code when logging into Word and Excel. When I tried to setup Outlook, and OneDrive I received a message that the account setup could not be completed.

I decided to disable the MFA, to see what would happen, and I was able to set up the Outlook account on the device. 

Now I want to enable MFA again, to see what occurs, but when I do, I'm still able to login without a 2nd authentication. Do I have to 'enforce' the MFA to reactivate it for the user?

If I select enforce, I get the following message:

So, does this mean that for Outlook and OneDrive apps, I need an app password with MFA enabled? And what does the note about admins refer to? 

Thanks

[#4]

As mentioned above, enabling OAuth/MFA does not disable the "legacy" authentication methods. If you want to disable those, you can use CA policies, Exchange auth policies or security defaults.

Both Outlook and OneDrive support MFA just fine, but you need to make sure you're using a proper version. Everything from the past few years will do, Office in particular added support in 2013 SP2. Apart from that, you need to make sure OAuth is enabled service-side, which for Exchange is done via PowerShell (although most tenants should have it already enabled).

Lastly, app passwords are not needed. They are a legacy "workaround" for scenarios where the client apps didnt support MFA, this is no longer the case for any Microsoft app.