# OWA Access

> Enable Outlook Web App (OWA) access to mailbox.

Enable Outlook Web App (OWA) access to mailbox. After beaching an account mal-actors often use Outlook in the Web browser to access mail data. You should consider setting OWA Enabled -> OFF for users/groups who do not use Outlook in the Web-browser.

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to
the tenant as a whole.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or
   bundle it into a user-level scheme and deploy that to many users or groups at once
   ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how
   Octiga resolves which value a user gets when a Direct value, a scheme and a group all
   supply one.
2. Leave **Outlook on the web access** set to On; it's the only setting on this baseline.
   It controls whether the user can sign in to their mailbox in a browser at
   outlook.office.com. After a breach, attackers commonly reach a compromised account's
   mail through the browser, so for a user with no need for webmail (they only use a
   desktop or mobile client), consider turning it off for them with a Direct value.
3. Save. Turn on **Auto-remediation** and Octiga switches Outlook on the web access back on
   automatically if it's disabled for a user it applies to.

## Check it worked

Passing means the mailbox's Outlook on the web access reports as enabled. Check it in the
Exchange admin centre under **Recipients → Mailboxes** → the user →
**Manage email apps settings**, where it appears as "Outlook on the web". On the user
roster or a group's member list, Passing shows as a green dot for this baseline;
Deviated (red) means it's currently off; Excluded (grey) means the user or tenant isn't
licensed for Exchange Online. A user with access off gets signed out of
outlook.office.com and can't sign back in from a browser until it's restored.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)