Skip to content
Octiga Docs
Copy as Markdown

Modern Authentication

ScopeTenantRoleL1 Read to view · L1 Read/Write to act

Modern Authentication uses OAuth 2.0 to provide secure access to Microsoft 365 services. Enabling Modern Authentication for your organization enhances security by supporting multi-factor authentication and conditional access, while disabling legacy authentication protocols.

Settings this baseline controls

SettingWhat it does
Modern authentication enabledEnables or disables modern authentication (OAuth 2.0) in Exchange Online. Learn more
Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

Configure it

This baseline keeps modern authentication on for Exchange Online across the tenant. It’s a foundation setting: the other Remote Access baselines that block individual legacy mail protocols assume modern authentication is already on underneath them.

  1. Add the baseline to the tenant (Adding a baseline), or deploy it to many tenants at once as part of a scheme (Deploying a scheme).

  2. Leave Modern authentication enabled set to On. It’s Microsoft’s default, so most tenants already pass. It makes Outlook 2013 and later on Windows sign in with OAuth 2.0 instead of a plain username and password, which is what lets those clients support multi-factor authentication and Conditional Access.

  3. This setting only governs Outlook 2013 and later on Windows. Outlook Mobile, Outlook for Mac and Exchange ActiveSync clients always use modern authentication, and IMAP and POP clients aren’t affected; their own baselines cover them.

  4. Save. Turn on Auto-remediation and Octiga switches this back on automatically if it’s turned off in Microsoft 365.

Check it worked

Passing means Exchange Online’s organisation configuration reports OAuth2ClientProfileEnabled as True. Check it in the Microsoft 365 admin centre under Settings → Org settings → Modern authentication. Users on Outlook for Windows 2013 or later may be asked to sign in again the next time they open Outlook after this changes. The modern sign-in dialog looks different from the old basic-authentication one, but nothing else about their mailbox changes. Everyone else notices nothing.

Standards this addresses

CISM365 6.5.1v8 4.8
NISTPR.AC-1IA-5
ISO 27001A.8.3

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme