(L1) Ensure modern authentication for Exchange Online is enabled
CIS.M365.6.5.1LowExchange OnlineClient accessPreview 3.0
Part of CIS · Exchange Online · Client access · All checks
Invoke-Maester -TestId CIS.M365.6.5.1Overview
Section titled “Overview”Modern authentication is enabled for Exchange Online.
The OAuth2ClientProfileEnabled setting turns on modern authentication for supported Outlook for Windows clients (Outlook 2013 and later). It allows these clients to support multifactor authentication and Conditional Access. If it is turned off, these Outlook connections can fail to sign in, because Exchange Online no longer supports basic authentication for them.
It is on by default for tenants created after August 2017. For older tenants, or if someone turned it off, enable it.
Remediation action
Section titled “Remediation action”To enable modern authentication in the Microsoft 365 admin center:
- Go to Microsoft 365 admin center > Settings > Org settings > Modern authentication.
- Select Turn on modern authentication for Outlook 2013 for Windows and later (recommended).
- Select Save.
To enable modern authentication with PowerShell:
- Connect to Exchange Online with
Connect-ExchangeOnline. - Run
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true. - Check the setting with
Get-OrganizationConfig | Format-List OAuth2ClientProfileEnabled.
Related links
Section titled “Related links”- Microsoft 365 admin center - Modern authentication
- Enable or disable modern authentication for Outlook in Exchange Online
- Set-OrganizationConfig
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.5.1
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.5.1 |
| Severity | Low |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Client access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.5.1, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCisExchangeModernAuthentication |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.6.5.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.5.1.md