Exchange 2019 + ADFS is it possible to configure ModernAuth for third-party Android mail clients?
Hello, Our organization operates under Uzbekistan's data localization and banking secrecy regulations, which require customer and corporate data — including email — to remain on infrastructure physically located within the country and under direct regulatory oversight. This precludes the use of cloud-hosted mail services such as Microsoft 365/Exchange Online, and requires a fully on-premises Exchange deployment with local identity federation (AD FS) instead of Azure AD. Environment: Exchange Server 2019 CU14, single server (MX01), pure on-premises. AD FS is registered as an AuthServer (Type: ADFS), no Azure AD / hybrid tenant involved. The AuthServer is configured correctly: AuthorizationEndpoint and TokenIssuingEndpoint are populated, IsDefaultAuthorizationEndpoint: True, and DomainName points to our mail domain. Realm/ServiceName are configured as well. Symptom: The native iOS Mail client (account added manually, no MDM profile) correctly redirects to our AD FS login page on first setup — the full Modern Auth flow works. A third-party EAS client (Nine by NitroDesk, Android) never receives an OAuth challenge at all — it falls back to Basic authentication. Get-ActiveSyncVirtualDirectory/Set-ActiveSyncVirtualDirectory in this build simply has no -OAuthAuthentication parameter (unlike EWS/OAB). Log finding: When testing with the Nine client, the following was captured in the Exchange HttpProxy/Eas logs: S:ServiceCommonMetadata.OAuthError=Flighting is not enabled for domain 'webmail.<domain>'. S:ServiceCommonMetadata.OAuthErrorCategory=OAuthNotAvailable Questions: What exactly controls "Flighting" for EAS OAuth in a pure on-prem Exchange 2019 CU14 + AD FS scenario (no Azure AD)? Is there a documented, supported way to enable it (New-FlightOverride? something else)? Is EAS Modern Auth even supported for an arbitrary/generic OAuth client (not Apple, not Outlook) in this scenario, or is it effectively an allowlist limited to specific client_ids (Apple Native Mail / Outlook)? How does native iOS Mail get redirected to AD FS without ever receiving an authorization_uri in the EAS/Autodiscover 401 challenge — is there an undocumented discovery path (e.g., hardcoded per registered client_id)? Thank you in advance for any insight.
Exchange on-premise create mailbox or login using access token bearer
hello everyone! We have an external oauth2 server for SSO. Now we must use that server to authenticate our users. We are not allowed to create users, we just have to authenticate the users via SSO and get the information via Access Token, and based on that token we have to either create a mailbox for new users or login to the mailbox if the user already has a mailbox created. the SSO server guys provide us with the ClientID, ClientSecret, RedirectURI, etc... In addition to the below URL: https://< SSO-Server>/oauth2/authorize/?client_id=< ClientID>&response_type=token&redirect_uri=https://< Exchange-Server>/owa/&scope=profile We are using Exchange Server 2019 CU 13 on-premise, I don't know what to do! I'm not sure how to config the server. I'd appreciate any help. I tried to redirect the owa to the above link using "Set-OrganizationConfig -AdfsIssuer" It will redirect to the SSO and then SSO will authenticate the user and redirect the user to the specific link I provide + an Access Token But how can I use that access token to create a new mailbox user?
Using confidential client application example to obtain OAuth2 token and sending email via SMTP
Hello All, I am trying to use the confidential client MSAL example to obtain a bearer token and then login to exchange using xoauth2. The example is available here: https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/dev/sample/confidential_client_secret_sample.py I am able to obtain the access token but authentication to exchange is always un-successful. Due to the nature of this grant (client grant), the scope used is https://graph.microsoft.com/.default. However, in the application api permissions on azure portal, I have added SMTP.Send. I'd appreciate if someone can help me whether the confidential client application can be used in this manner. I've also tried public client application with device flow, but the result is still the same. Arshad