Microsoft delays disabling Basic Authentication for several Exchange Online protocols 'until further notice'
(2021/02/05)
- Reference: 1612526110
- News link: https://www.theregister.co.uk/2021/02/05/exchange_online_basic_authentication/
- Source link:
Microsoft has [1]shifted gears on plans to disable Basic Authentication for five Exchange Online protocols this year, provided your tenant is actually using them.
It's a change from [2]previous proclamations on the issue and is in recognition of the fact that some IT admins simply haven't got round to dealing with the problem yet.
[3]
After all, the world has changed considerably since the last announcement and IT professionals have had their hands full with an unexpected exodus from the office.
The company has also tweaked how the disabling will happen.
[4]
Most importantly, "until further notice" Basic Auth will not be disabled for any protocols a tenant is using. It will, however, be disabled for protocols that are enabled (likely through a legacy setting that everyone has forgotten about) but not being used. Microsoft plans to check usage records over the next few months to check for those unused protocols.
For those curious what "further notice" actually means, Microsoft elaborated: "We will provide a minimum of twelve months notice before we block the use of Basic Auth on any protocol being used in your tenant."
It will also be adding MAPI, RPC, and Offline Address Book (OAB) to the list of protocols for which Basic Auth will be disabled should they not be in active use.
Microsoft would dearly [5]like organisations to make the switch to Modern Authentication. Replete with multi-factor authentication (MFA), smart cards, certificate-based authentication (CBA), and third-party SAML identity providers, and based on the Active Directory Authentication Library (ADAL) and OAuth 2.0, it is a good deal more secure than the venerable Basic Authentication.
It was also enabled for all new tenants from 1 August 2017. Enabling for those created earlier required some manual intervention.
For many, however, older versions of little-used apps such as, er, Outlook for Windows and Mac present the biggest headache. Outlook 2013 for Windows can use Modern Authentication and Outlook for Mac got the feature in a 2016 update. Updating a fleet of legacy hardware and software in the midst of a pandemic is far from ideal even if important from a security standpoint.
The move has not been greeted with delight. One user said: "I am disappointed that Microsoft is not taking a stronger stance against basic authentication and disabling it (excluding SMTP) outright."
Admins beware! Microsoft gives heads-up for 'disruptive' changes to authentication in Office 365 email service [6]READ MORE
Another said: "We have worked for nearly two years to push our app developers both internal and external to modern auth. We've put in a tremendous amount of work and now Microsoft is backtracking on this... Microsoft not disabling it implies consent to use and will result in third party developers avoiding the update. This is very disappointing news."
Greg Taylor, director of product marketing for Exchange Server and Exchange Online, attempted to address the issues: "We're not backtracking, if anything, by increasing the number of protocols we're covering we're actually doing more in the long term. Timing is the biggest challenge, nothing more."
The list of protocols for the Basic Authentication chop has indeed grown, and stands at EWS, EAS, POP, IMAP, Remote PowerShell, MAPI, RPC, SMTP AUTH, and OAB. However, the proviso that the axe swings only for those not in use, with no firm deadline for when users must move on.
Twitter was, as ever, its usual supportive self for IT teams that had yet to make the jump. ®
[7]
I mean that this is only excuse for really lazy IT departments that they should not care. Because if they do not care, you step back. — Petr Vlk (@Kazzan) [8]February 4, 2021
Get our [9]Tech Resources
[1] https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-february-2021-update/ba-p/2111904
[2] https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-july-update/ba-p/1530163
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YB15qRnbvC1m8qqJPvcwOAAAAIY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YB15qRnbvC1m8qqJPvcwOAAAAIY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2020/02/26/exchange_online_microsoft/
[6] https://www.theregister.com/2020/02/26/exchange_online_microsoft/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YB15qRnbvC1m8qqJPvcwOAAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://twitter.com/Kazzan/status/1357375179551363073?ref_src=twsrc%5Etfw
[9] https://whitepapers.theregister.com/
It's a change from [2]previous proclamations on the issue and is in recognition of the fact that some IT admins simply haven't got round to dealing with the problem yet.
[3]
After all, the world has changed considerably since the last announcement and IT professionals have had their hands full with an unexpected exodus from the office.
The company has also tweaked how the disabling will happen.
[4]
Most importantly, "until further notice" Basic Auth will not be disabled for any protocols a tenant is using. It will, however, be disabled for protocols that are enabled (likely through a legacy setting that everyone has forgotten about) but not being used. Microsoft plans to check usage records over the next few months to check for those unused protocols.
For those curious what "further notice" actually means, Microsoft elaborated: "We will provide a minimum of twelve months notice before we block the use of Basic Auth on any protocol being used in your tenant."
It will also be adding MAPI, RPC, and Offline Address Book (OAB) to the list of protocols for which Basic Auth will be disabled should they not be in active use.
Microsoft would dearly [5]like organisations to make the switch to Modern Authentication. Replete with multi-factor authentication (MFA), smart cards, certificate-based authentication (CBA), and third-party SAML identity providers, and based on the Active Directory Authentication Library (ADAL) and OAuth 2.0, it is a good deal more secure than the venerable Basic Authentication.
It was also enabled for all new tenants from 1 August 2017. Enabling for those created earlier required some manual intervention.
For many, however, older versions of little-used apps such as, er, Outlook for Windows and Mac present the biggest headache. Outlook 2013 for Windows can use Modern Authentication and Outlook for Mac got the feature in a 2016 update. Updating a fleet of legacy hardware and software in the midst of a pandemic is far from ideal even if important from a security standpoint.
The move has not been greeted with delight. One user said: "I am disappointed that Microsoft is not taking a stronger stance against basic authentication and disabling it (excluding SMTP) outright."
Admins beware! Microsoft gives heads-up for 'disruptive' changes to authentication in Office 365 email service [6]READ MORE
Another said: "We have worked for nearly two years to push our app developers both internal and external to modern auth. We've put in a tremendous amount of work and now Microsoft is backtracking on this... Microsoft not disabling it implies consent to use and will result in third party developers avoiding the update. This is very disappointing news."
Greg Taylor, director of product marketing for Exchange Server and Exchange Online, attempted to address the issues: "We're not backtracking, if anything, by increasing the number of protocols we're covering we're actually doing more in the long term. Timing is the biggest challenge, nothing more."
The list of protocols for the Basic Authentication chop has indeed grown, and stands at EWS, EAS, POP, IMAP, Remote PowerShell, MAPI, RPC, SMTP AUTH, and OAB. However, the proviso that the axe swings only for those not in use, with no firm deadline for when users must move on.
Twitter was, as ever, its usual supportive self for IT teams that had yet to make the jump. ®
[7]
I mean that this is only excuse for really lazy IT departments that they should not care. Because if they do not care, you step back. — Petr Vlk (@Kazzan) [8]February 4, 2021
Get our [9]Tech Resources
[1] https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-february-2021-update/ba-p/2111904
[2] https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-july-update/ba-p/1530163
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YB15qRnbvC1m8qqJPvcwOAAAAIY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YB15qRnbvC1m8qqJPvcwOAAAAIY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2020/02/26/exchange_online_microsoft/
[6] https://www.theregister.com/2020/02/26/exchange_online_microsoft/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YB15qRnbvC1m8qqJPvcwOAAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://twitter.com/Kazzan/status/1357375179551363073?ref_src=twsrc%5Etfw
[9] https://whitepapers.theregister.com/
fnusnu
Can someone translate that final tweet for me?
Modern authentication is not a standard
DonL
The problem is that "modern authentication" is not a standard, although it uses a few standard protocols. Also the authentication token that is received afterwards need to be renewed regularly, which is also not a standard. And then how would you be able to use this with POP3 or IMAP?
If they were to disable basic authentication then you could only connect products to Office 365 that explicitly support it.
The servicedesk application we are using for example supports POP3/IMAP but not the Microsoft proprietary implementation.
The only solution I could personally come up with was to forward all mail to our own server and then fetch the mail with IMAP from there.
The following statement also indicates the issue:
"We have worked for nearly two years to push our app developers both internal and external to modern auth. We've put in a tremendous amount of work"
Microsoft spinned the change as a simple security improvement, but in reality a lot of stuff needs to be done only to implement support for Office365. If Gmail where to do the same, it wouldn't even be compatible and you'd need to put in the same amount of work for every provider you'd want to support.
legacy
There's an awful lot of automated mailing stuff in apps here there and everywhere that use basic SMTP for sending out emails. e.g. lots of commercial products that send customers automatic progress emails when an event happens e.g. order taken, order shipped etc.
That legacy codebase needs SMTP servers that just happily do basic auth