This change affects the applications and scripts you might use in different ways. Impact to messaging protocols and existing applications All other cloud environments were subject to the Octodate. In Office 365 Operated by 21Vianet, we began disabling Basic authentication on March 31, 2023. When did this change take place?īeginning in early 2021, we started to disable Basic authentication for existing tenants with no reported usage.īeginning in early 2023, we disabled Basic authentication for all tenants who had any type of extension. Enabling and enforcing multifactor authentication (MFA) is also simple with Modern authentication. For example, OAuth access tokens have a limited usable lifetime, and are specific to the applications and resources for which they are issued, so they cannot be reused.

Modern authentication (OAuth 2.0 token-based authorization) has many benefits and improvements that help mitigate the issues in basic authentication. This decision requires customers to move from apps that use basic authentication to apps that use Modern authentication. We also disabled SMTP AUTH in all tenants where it wasn't being used. We removed the ability to use Basic authentication in Exchange Online for Exchange ActiveSync (EAS), POP, IMAP, Remote PowerShell, Exchange Web Services (EWS), Offline Address Book (OAB), Autodiscover, Outlook for Windows, and Outlook for Mac. The deprecation of basic authentication also prevents the use of app passwords with apps that don't support two-step verification.

With these threats and risks in mind, we took steps to improve data security in Exchange Online. These alternatives allow for intelligent decisions about who is trying to access what from where on which device rather than simply trusting an authentication credential that could be a bad actor impersonating a user. We actively recommend that customers adopt security strategies such as Zero Trust (Never Trust, Always Verify), or apply real-time assessment policies when users and devices access corporate information. Threats posed by it have only increased since we originally announced that we were going to turn it off (see Improving Security - Together) There are better and more effective user authentication alternatives. Furthermore, the enforcement of multifactor authentication (MFA) is not simple or in some cases, possible when Basic authentication remains enabled.īasic authentication is an outdated industry standard. Simplicity isn't at all bad, but Basic authentication makes it easier for attackers to capture user credentials (particularly if the credentials are not protected by TLS), which increases the risk of those stolen credentials being reused against other endpoints or services. Traditionally, Basic authentication is enabled by default on most servers or services, and is simple to set up. Basic authentication simply means the application sends a username and password with every request, and those credentials are also often stored or saved on the device. Read the rest of this article to fully understand the changes we made and how these changes might affect you.įor many years, applications have used Basic authentication to connect to servers, services, and API endpoints. Now no one (you or Microsoft support) can re-enable Basic authentication in your tenant. Basic authentication is now disabled in all tenants.īefore December 31 2022, you could re-enable the affected protocols if users and apps in your tenant couldn't connect.

Send anywhere alternative