I have not been able to find anything official (or any at all) regarding this specific questions. My Bing/Google-fu may be failing me.
Is an ActiveSync device (e.g. IOS 13) profile supposed to switch to OAuth after the migration to Office 365? If not automatically, is there a method to convert an existing ActiveSync profile to switch to OAuth/Modern Auth?
I'm surprised this issue had never come up for me before with the several clients I've migrated to Office 365. The issue became apparent when the client began piloting MFA conditional access policies. The pilot users had their mailboxes migrated from on-prem Exchange 2013 to Office 365 a while ago ago and the ActiveSync profile properly reconfigured automatically for Office 365 at that time. However, once MFA was enforced for the pilot users, the ActiveSync profile was no longer able to sync and would prompt for credentials. Correct credentials would not be accepted.
Deleting and recreating the profile seems to have fixed it.
My theory is that the ActiveSync profile continues to use the original authentication method (legacy) after a migration. Once MFA was enforced on the user, Modern Authentication/OAuth became required; and ActiveSync -- still configured for legacy -- could not successfully authenticate.
It's a perfectly logical and acceptable explanation to me, but I'm trying to find official information about this behavior to provide to the client.
