IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft to scrap Basic Authentication in Exchange Online

The tech giant has announced October 2022 as the cut-off date for Exchange Online tenants

Microsoft will turn off Basic Authentication on all protocols for all tenants of its Exchange Online service starting October 1, 2022.

Microsoft said it will permanently disable this type of authentication regardless of usage - except for SMTP Auth, which can still be re-enabled after this date. 

The company was originally going to turn off this service in October 2020 before the coronavirus pandemic continued its stranglehold on the world. However, it has started disabling Basic Authentication for some users who weren’t using it earlier in June. 

“Basic Authentication is an outdated industry standard, and threats posed by Basic Auth have only increased in the time since we originally announced we were making this change,” the firm said. “Every day Basic Auth remains enabled in your tenant, your data is at risk, and so your role is to get your clients and apps off Basic Auth, move them to stronger and better options, and then secure your tenant, before we do."

From the beginning of next year, Microsoft will begin disabling Basic Authentication for some customers with usage on a short-term and temporary basis.

Related Resource

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Whitepaper front coverDownload now

Microsoft added that many customers have focused on other problems over the past year, and they might need to do more work in this area to be ready on time. “We hope that giving you 12 months’ notice will give you sufficient time to prepare,” it said.

Steven Hope, CEO, and co-founder of Authlogics, said all the traffic should be protected with SSL to keep the credentials a secret. However, with various SSL attacks, including man-in-the-middle, it can’t always be assumed the credentials are safe.

“Furthermore, Basic Authentication does not allow for anything other than a fixed password, so there is no way to use it with a One Time Code or biometrics, for example. Customers are now being forced to embrace “Modern Authentication” as Microsoft calls it, but is basically a web-based login interface to generate an authentication token which can be reused for a period of time,” he said.

“The web interface allows for multi-factor authentication, from Microsoft as well as third parties, to be used which is a huge step forward. Is the change going to break things for those that are not prepared? Yes. Is it worth getting this done and out the way once and for all? Certainly yes!” 

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Microsoft launches low-code Power Pages for 'intuitive' web development
web development

Microsoft launches low-code Power Pages for 'intuitive' web development

24 May 2022
Windows 11's nifty new search feature has one major downside
Microsoft Windows

Windows 11's nifty new search feature has one major downside

23 May 2022
Microsoft says it's provided over $100 million in tech support to Ukrainian government
cyber attacks

Microsoft says it's provided over $100 million in tech support to Ukrainian government

20 May 2022
Mastering endpoint security implementation
Security

Mastering endpoint security implementation

18 May 2022

Most Popular

Open source packages with millions of installs hacked to harvest AWS credentials
hacking

Open source packages with millions of installs hacked to harvest AWS credentials

24 May 2022
Nvidia pauses hiring to help cope with inflation
Careers & training

Nvidia pauses hiring to help cope with inflation

23 May 2022
Microsoft finally adds Power BI integrations to PowerPoint and Outlook
business intelligence (BI)

Microsoft finally adds Power BI integrations to PowerPoint and Outlook

25 May 2022