OWA Access
Enable Outlook Web App (OWA) access to mailbox. After beaching an account mal-actors often use Outlook in the Web browser to access mail data. You should consider setting OWA Enabled -> OFF for users/groups who do not use Outlook in the Web-browser.
Adding a baselineConfigure it
This baseline applies per user, through a user-level scheme or an Azure group, rather than to the tenant as a whole.
-
Add it directly to a user or an Azure group (Adding a baseline), or bundle it into a user-level scheme and deploy that to many users or groups at once (Deploying a scheme). See Groups and priority for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.
-
Leave Outlook on the web access set to On; it’s the only setting on this baseline. It controls whether the user can sign in to their mailbox in a browser at outlook.office.com. After a breach, attackers commonly reach a compromised account’s mail through the browser, so for a user with no need for webmail (they only use a desktop or mobile client), consider turning it off for them with a Direct value.
-
Save. Turn on Auto-remediation and Octiga switches Outlook on the web access back on automatically if it’s disabled for a user it applies to.
Check it worked
Passing means the mailbox’s Outlook on the web access reports as enabled. Check it in the Exchange admin centre under Recipients → Mailboxes → the user → Manage email apps settings, where it appears as “Outlook on the web”. On the user roster or a group’s member list, Passing shows as a green dot for this baseline; Deviated (red) means it’s currently off; Excluded (grey) means the user or tenant isn’t licensed for Exchange Online. A user with access off gets signed out of outlook.office.com and can’t sign back in from a browser until it’s restored.
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.