Ensure modern authentication for Exchange Online is enabled
MT.1044LowExchange OnlineClient access
Part of Maester · Exchange Online · Client access · All checks
Invoke-Maester -TestId MT.1044Overview
Section titled “Overview”Modern authentication for Exchange Online MUST be enabled
Rationale: Modern authentication enables enhanced security features like multifactor authentication (MFA), certificate-based authentication (CBA), and third-party SAML identity providers. Without modern authentication, users are more vulnerable to password-based attacks.
Remediation action
Section titled “Remediation action”- Connect to Exchange Online:
Connect-ExchangeOnline- Enable modern authentication:
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true- Verify the setting:
(Get-OrganizationConfig).OAuth2ClientProfileEnabledThe result should be True.
Related links
Section titled “Related links”- Enable or disable modern authentication in Exchange Online
- Modern authentication overview
- Microsoft Secure Score - Enable modern authentication
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1044 |
| Severity | Low |
| Suite | Maester |
| Product | Exchange Online |
| Feature | Client access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force |
| PowerShell test | Test-MtExoModernAuth |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/maester/exchange/Test.MT.1044.ps1 - Documentation:
tests/maester/exchange/Test.MT.1044.md