# (L1) Ensure modern authentication for Exchange Online is enabled

(L1) Ensure modern authentication for Exchange Online is enabled. A Maester check for Exchange Online, Client access.

Source: https://maester.dev/docs/tests/CIS.M365.6.5.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Exchange Online · Client access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.6.5.1
```

## Overview

Modern authentication is enabled for Exchange Online.

The `OAuth2ClientProfileEnabled` setting turns on modern authentication for supported Outlook for Windows clients (Outlook 2013 and later). It allows these clients to support multifactor authentication and Conditional Access. If it is turned off, these Outlook connections can fail to sign in, because Exchange Online no longer supports basic authentication for them.

It is on by default for tenants created after August 2017. For older tenants, or if someone turned it off, enable it.

#### Remediation action

To enable modern authentication in the Microsoft 365 admin center:

1. Go to [Microsoft 365 admin center > Settings > Org settings > Modern authentication](https://admin.microsoft.com/#/Settings/Services/:/Settings/L1/ModernAuthentication).
2. Select **Turn on modern authentication for Outlook 2013 for Windows and later (recommended)**.
3. Select **Save**.

To enable modern authentication with PowerShell:

1. Connect to Exchange Online with `Connect-ExchangeOnline`.
2. Run `Set-OrganizationConfig -OAuth2ClientProfileEnabled $true`.
3. Check the setting with `Get-OrganizationConfig | Format-List OAuth2ClientProfileEnabled`.

#### Related links

* [Microsoft 365 admin center - Modern authentication](https://admin.microsoft.com/#/Settings/Services/:/Settings/L1/ModernAuthentication)
* [Enable or disable modern authentication for Outlook in Exchange Online](https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online)
* [Set-OrganizationConfig](https://learn.microsoft.com/powershell/module/exchange/set-organizationconfig)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.5.1](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.6.5.1 |
| Severity | Low |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Client access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.5.1, nist-800-53-r5:IA-2 |
| PowerShell test | [Test-MtCisExchangeModernAuthentication](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.1.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.6.5.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.1.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.6.5.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.1.md)