# Modern Authentication

> Modern Authentication uses OAuth 2.

Modern Authentication uses OAuth 2.0 to provide secure access to Microsoft 365 services. Enabling Modern Authentication for your organization enhances security by supporting multi-factor authentication and conditional access, while disabling legacy authentication protocols.

## Settings this baseline controls

| Setting                       | What it does                                                                                                                                                                                 |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Modern authentication enabled | Enables or disables modern authentication (OAuth 2.0) in Exchange Online. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-organizationconfig?view=exchange-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline keeps modern authentication on for Exchange Online across the tenant. It's a
foundation setting: the other Remote Access baselines that block individual legacy mail
protocols assume modern authentication is already on underneath them.

1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to
   many tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Leave **Modern authentication enabled** set to On. It's Microsoft's default, so most
   tenants already pass. It makes Outlook 2013 and later on Windows sign in with OAuth 2.0
   instead of a plain username and password, which is what lets those clients support
   multi-factor authentication and Conditional Access.
3. This setting only governs Outlook 2013 and later on Windows. Outlook Mobile, Outlook for
   Mac and Exchange ActiveSync clients always use modern authentication, and IMAP and POP
   clients aren't affected; their own baselines cover them.
4. Save. Turn on **Auto-remediation** and Octiga switches this back on automatically if it's
   turned off in Microsoft 365.

## Check it worked

Passing means Exchange Online's organisation configuration reports
`OAuth2ClientProfileEnabled` as `True`. Check it in the Microsoft 365 admin centre under
**Settings → Org settings → Modern authentication**. Users on Outlook for Windows 2013 or
later may be asked to sign in again the next time they open Outlook after this changes. The
modern sign-in dialog looks different from the old basic-authentication one, but nothing else
about their mailbox changes. Everyone else notices nothing.

## Standards this addresses

### CIS

- **M365 6.5.1** — CIS M365 Foundations Benchmark 6.5.1
- **v8 4.8** — CIS Controls v8 Safeguard 4.8

### NIST

- **PR.AC-1** — NIST CSF 2.0 PR.AC-1
- **IA-5** — NIST SP 800-53 IA-5

### ISO 27001

- **A.8.3** — ISO/IEC 27001:2022 Annex A.8.3

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)