--- title: "Learn How to Switch to Modern Authentication in Office 365" description: "Enhance your IT organizations security and capabilities by switching to modern authentication in Office 365 in this ATA Learning tutorial!" canonical: "https://adamtheautomator.com/modern-authentication-in-office-365/" --- # Learn How to Switch to Modern Authentication in Office 365 > Enhance your IT organizations security and capabilities by switching to modern authentication in Office 365 in this ATA Learning tutorial! Source: https://adamtheautomator.com/modern-authentication-in-office-365/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Learn How to Switch to Modern Authentication in Office 365](https://adamtheautomator.com/wp-content/uploads/2022/07/Learn-How-to-Switch-to-Modern-Authentication-in-Office-365.jpg) # Learn How to Switch to Modern Authentication in Office 365 [![](https://secure.gravatar.com/avatar/9a14f10ff1b1ec7d790d34f5b559e4d3de2d31b172e6ef266dfd8b479174d97b?s=192&d=mm&r=g)June Castillote](https://adamtheautomator.com/author/june/)11 August 20227 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Microsoft Azure](/tag/microsoft-azure/) Table of Contents * [Prerequisites](#prerequisites) * [Analyzing Basic Authentication Usage in your Tenant](#analyzing-basic-authentication-usage-in-your-tenant) * [Sign-in Logs Report in the Azure AD Admin Center](#sign-in-logs-report-in-the-azure-ad-admin-center) * [Sign-in Logs Report using the Azure AD PowerShell](#sign-in-logs-report-using-the-azure-ad-powershell) * [Enabling Modern Authentication in Office 365 Organization](#enabling-modern-authentication-in-office-365-organization) * [Verifying the Modern Authentication Settings](#verifying-the-modern-authentication-settings) * [Enabling Modern Authentication Office 365 Outlook Clients](#enabling-modern-authentication-office-365-outlook-clients) * [Outlook 2013](#outlook-2013) * [Outlook 2016, Outlook 2019, and Outlook 365](#outlook-2016-outlook-2019-and-outlook-365) * [Confirming Outlook Modern Authentication](#confirming-outlook-modern-authentication) * [Conclusion](#conclusion) Did you know that switching-_on_ modern authentication doesn’t automatically switch off basic authentication? There are steps that you must do to complete the switch _to_ modern authentication Office 365. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** Microsoft’s momentum in removing basic authentication appears unstoppable now. They’ve started disabling basic authentication on tenants that do not use them. If you haven’t enabled modern authentication in Office 365, let this article help you get started with step-by-step examples. > _As of August 1, 2017, newly created tenants already enforced [security defaults](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults), which enables modern authentication and blocks basic authentication. If the security defaults are already enabled in your tenant, this tutorial will not apply to you._ > > _Reference: [Security defaults in Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults)._ ## Prerequisites > _Microsoft 365 Backup For Dummies eBook addresses the data security challenges by outlining the out-of-the-box security features in Microsoft 365. [Get eBook](https://go.veeam.com/office-365-backup-for-dummies?utm_campaign=01BR-M365-GB_Global_EN_0_Custom_WP_dummies-office365&utm_source=adamtheautomator.com&utm_medium=dcm&st=pa&ccode=dcmbloggers)_ This tutorial will be a hands-on demonstration. If you’d like to follow along, you must have Global administrator access to a Microsoft 365 tenant. ## Analyzing Basic Authentication Usage in your Tenant Before tinkering with modern authentication, you must assess whether basic authentication is still in use in your tenant. This way, if there are still users or applications using basic authentication, you can inform the responsible parties that basic authentication will stop working soon. > _NOTE: The following subsections involve extracting the Sign-in logs in Azure AD, which require that you have an Azure AD Premium P1 license in your tenant._ ### Sign-in Logs Report in the Azure AD Admin Center Follow these steps to export a basic authentication usage report in the Azure AD admin center. 1\. Open your web browser and log in to the [Azure Active Directory admin center](https://aad.portal.azure.com/). 2\. Next, click on Azure Active Directory → Sign-in logs. ![Open the Sign-in logs blade](https://adamtheautomator.com/wp-content/uploads/2022/07/image-563.png) Open the Sign-in logs blade 3\. When you see the Sign-in logs, click on Add filters → Client app → Apply. This step enables you to filter the records based on the client application. ![Adding the client app filter to the sign-in logs](https://adamtheautomator.com/wp-content/uploads/2022/07/image-564.png) Adding the client app filter to the sign-in logs 4\. Now, click on the Client app filter you added, check every item under the Legacy Authentication Clients section, and click Apply. ![Filtering by client apps](https://adamtheautomator.com/wp-content/uploads/2022/07/image-565.png) Filtering by client apps 5\. Next, adjust the date filter to Last 1 Month, or whichever period you believe is sufficient. ![Adjust the date coverage](https://adamtheautomator.com/wp-content/uploads/2022/07/image-566.png) Adjust the date coverage 6\. If there are results after applying the filter, there are still users or applications using the basic authentication. Click on Download → Download JSON or Download CSV, depending on which file format you prefer for the report and analysis. ![Selecting the download format](https://adamtheautomator.com/wp-content/uploads/2022/07/image-567.png) Selecting the download format 7\. Finally, click the Download button under which report you wish to download. This example downloads the Interactive Sign-ins report to a CSV file. ![Downloading the legacy authentication report](https://adamtheautomator.com/wp-content/uploads/2022/07/image-568.png) Downloading the legacy authentication report ### Sign-in Logs Report using the Azure AD PowerShell If you want more control over the fields to report, you could use PowerShell instead. This method requires the [AzureADPreview](https://docs.microsoft.com/en-us/powershell/module/azuread/?view=azureadps-2.0-preview) module, which includes the [Get-AzureADAuditSignInLogs](https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureadauditsigninlogs?view=azureadps-2.0-preview?view=azureadps-2.0-preview) cmdlet for extracting sign-in logs. 1\. Open an elevated [PowerShell](https://adamtheautomator.com/powershell-run-as-administrator/). Related:[Discover How to Run PowerShell as Administrator](https://adamtheautomator.com/powershell-run-as-administrator/) 2\. Install the AzureADPreview module if you haven’t installed it yet. ```powershell Install-Module AzureADPreview ``` 3\. Next, [connect to Azure Active Directory](https://docs.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0-preview) PowerShell by running the below cmdlet. Log in with your Global administrator credential. ```powershell Connect-AzureAD ``` 4\. Construct a filter with the following conditions and store it in the `$filter` variable. * `clientAppUsed` is not `Mobile Apps and Desktop clients` AND * `clientAppUsed` is not `Browser` AND * `clientAppUsed` is not empty `''` AND * `createdDateTime is greater than or equal to -30 days.` ```powershell $filter = @" ClientAppUsed ne 'Mobile Apps and Desktop clients' and ClientAppUsed ne 'Browser' and ClientAppUsed ne '' and CreatedDateTime gt $((Get-Date).AddDays(-30).ToString('yyyy-MM-dd')) "@ ``` 5\. Run the below command to execute the Get-AzureADAuditSignInLogs cmdlet with the filter and return only the CreatedDateTime, UserPrincipalName, AppDisplayName, and ClientAppUsed properties. The output will export to a CSV file called BasicAuthSignIn.csv. ```powershell # Get the sign-in logs $signInlogs = Get-AzureADAuditSignInLogs -Filter $filter | ` Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName, ClientAppUsed # Display the result on the screen $signInLogs ``` According to the below results, there is still Authenticated SMTP usage within the last 30 days, which is a form of basic authentication. > _The clientAppUsed values other than Mobile Apps and Desktop clients and Browser are using legacy or basic authentication._ ![Getting the legacy sign-in report using Azure AD PowerShell](https://adamtheautomator.com/wp-content/uploads/2022/07/image-569.png) Getting the legacy sign-in report using Azure AD PowerShell 6\. Optionally, consider exporting the sign-in logs to a CSV file for later use. ```powershell $signInlogs | Export-Csv .\BasicAuthSignIn.csv -NoTypeInformation ``` Related:[Export-Csv: Converting Objects to CSV Files](https://adamtheautomator.com/export-csv/) ## Enabling Modern Authentication in Office 365 Organization Have you informed your users about the planned switch to modern authentication? If so, and you’ve already completed any other possible preparations your organization may require, you’re ready to start the switch. The quickest way to enable modern authentication is through the [Microsoft 365 admin center](https://admin.microsoft.com/), and below are the step to do so. 1\. Log in to the [Microsoft 365 admin center](https://admin.microsoft.com/) using your web browser. 2\. Click Settings → Org Settings → Modern authentication. ![Opening Modern authentication settings](https://adamtheautomator.com/wp-content/uploads/2022/07/image-570.png) Opening Modern authentication settings 3\. On the Modern authentication fly-out page that appears, check the Turn on modern authentication for Outlook 2013 for Windows and later (recommended) box and click Save. ![Turn on the modern authentication](https://adamtheautomator.com/wp-content/uploads/2022/07/image-571.png) Turn on the modern authentication Once you’ve clicked Save to enable modern authentication, additional options will appear: **Allow access to basic authentication protocols**. To block basic authentication completely, uncheck the following boxes and click **Save**. Each checkbox represents a protocol or service. * **Outlook client** (including Exchange Web Services (EWS), MAPI over HTTP, Offline Address Book, and Outlook Anywhere) * **Exchange ActiveSync (EAS)** * **Autodiscover** * **IMAP4** * **POP3** * **Authenticated SMTP (SMTP AUTH)** * **Exchange Online PowerShell** ![Blocking Basic Authentication](https://adamtheautomator.com/wp-content/uploads/2022/07/image-572.png) Blocking Basic Authentication 5\. Once you’ve saved the modern authentication changes, exit the Moden authentication fly out. ![Closing the modern authentication settings](https://adamtheautomator.com/wp-content/uploads/2022/07/image-573.png) Closing the modern authentication settings ## Verifying the Modern Authentication Settings Do you wonder what happened when you made ticked those modern authentication settings? You should! Understanding how those changes are applied to your tenant is crucial when you eventually need to troubleshoot authentication issues. > _The steps in this section require the [Exchange Online PowerShell V2 (EXO V2)](https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps?view=exchange-ps). The latest version, 2.0.5, works with Windows PowerShell 5.1 and [PowerShell 7+ on supported operating systems](https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps?view=exchange-ps?view=exchange-ps#supported-operating-systems-for-the-exo-v2-module)._ 1\. Open PowerShell and connect to Exchange Online. ```powershell Connect-ExchangeOnline -Organization your_tenant.onmicrosoft.com -ShowBanner:$false ``` Related:[How to Connect to Exchange Online PowerShell via v2 Module](https://adamtheautomator.com/exchange-online-v2/) 2\. When you turn on modern authentication, you technically set the OAuth2ClientProfileEnabled value in your Exchange Online organization configuration to true. Run the below command to verify that value. ```powershell Get-OrganizationConfig | Select-Object OAuth2ClientProfileEnabled ``` As you can see below, the OAuth2ClientProfileEnabled value is True, which means the modern authentication is on. ![Confirming the modern authentication setting status](https://adamtheautomator.com/wp-content/uploads/2022/07/image-574.png) Confirming the modern authentication setting status 3\. When you turned off each protocol’s basic authentication in the Microsoft 365 admin center, you technically created a new authentication policy in Exchange Online with the following parameters.
Parameter nameValueProtocol or service affected
AllowBasicAuthActiveSyncFalse (Blocked)Exchange Active Sync (EAS)
AllowBasicAuthAutodiscoverFalse (Blocked)Autodiscover
AllowBasicAuthImapFalse (Blocked)IMAP4
AllowBasicAuthMapiFalse (Blocked)MAPI over HTTP (MAPI/HTTP)
AllowBasicAuthOfflineAddressBookFalse (Blocked)Offline Address Book (OAB)
AllowBasicAuthPopFalse (Blocked)POP3
AllowBasicAuthRpcFalse (Blocked)Outlook Anywhere (RPC over HTTP)
AllowBasicAuthSmtpFalse (Blocked)Authenticated SMTP
AllowBasicAuthWebServicesFalse (Blocked)Exchange Web Services (EWS)
AllowBasicAuthPowerShellFalse (Blocked)PowerShell
Typically, the authentication policy name starts with BlockAuth\*. To verify that authentication policy, run the below code in PowerShell. ```powershell $authPolicyParams = @( 'Name','AllowBasicAuthActiveSync', 'AllowBasicAuthAutodiscover','AllowBasicAuthImap', 'AllowBasicAuthMapi','AllowBasicAuthOfflineAddressBook', 'AllowBasicAuthPop','AllowBasicAuthRpc', 'AllowBasicAuthSmtp','AllowBasicAuthWebServices', 'AllowBasicAuthPowerShell' ) Get-AuthenticationPolicy | Format-List $authPolicyParams ``` The result below confirms that the AllowBasic\* properties in the authentication policy are set to False, which means blocking basic authentication. ![Confirming basic authentication is blocked in the authentication policy](https://adamtheautomator.com/wp-content/uploads/2022/07/image-575.png) Confirming basic authentication is blocked in the authentication policy 4\. So you’ve confirmed the authentication policy blocks all basic authentication. How do you ensure that the authentication policy applies to your organization? To verify, get the DefaultAuthenticationPolicy property value from your Exchange Online organization configuration. ```powershell Get-OrganizationConfig | Select-Object DefaultAuthenticationPolicy ``` The result should show which authentication policy is the default in your organization, as you can see below. ![Confirming the Exchange Online organization’s default authentication policy](https://adamtheautomator.com/wp-content/uploads/2022/07/image-576.png) Confirming the Exchange Online organization’s default authentication policy ## Enabling Modern Authentication Office 365 Outlook Clients You’ve enabled modern authentication and blocked basic authentication—but your job doesn’t stop there. You must ensure that your Outlook clients on Windows can connect using modern authentication by modifying or adding some registry items. > _Note: If the registry entries for your version of Outlook do not exist, don’t panic, you only need to create them._ Related:[Effectively Use PowerShell to Get a Registry Value](https://adamtheautomator.com/powershell-to-get-a-registry-value/) > _Note: Outlook 2010 does not support modern authentication, and there are no available workarounds._ Open PowerShell as admin and run the commands appropriate to your Outlook version. ### Outlook 2013 Outlook 2013 supports modern authentication by default, but it is not active. To activate, modify the following registry entries. ```powershell # The two entries below enable modern authentication in Outlook 2013 Set-ItemProperty -Path HKCU:\\Software\\Microsoft\\Office\\15.0\\Common\\Identity -Name EnableADAL -Value 1 -Force Set-ItemProperty -Path HKCU:\\Software\\Microsoft\\Office\\15.0\\Common\\Identity -Name Version -Value 1 -Force # Create the HKCU:\\Software\\Microsoft\\Exchange\\AlwaysUseMSOAuthForAutoDiscover registry entry. # This value forces Outlook to always use modern authentication. New-Item -Path HKCU:\\Software\\Microsoft -Name 'Exchange' -Force New-ItemProperty -Path HKCU:\\Software\\Microsoft\\Exchange -Name 'AlwaysUseMSOAuthForAutoDiscover' -Value 1 -PropertyType DWORD -Force ``` ### Outlook 2016, Outlook 2019, and Outlook 365 Modern authentication is already enabled by default on Outlook 2016 and later versions. But Microsoft recommends setting the `AlwaysUseMSOAuthForAutoDiscover` value to force the use of modern authentication. ```powershell # Create the HKCU:\\Software\\Microsoft\\Exchange\\AlwaysUseMSOAuthForAutoDiscover registry entry. # This value forces Outlook to always use modern authentication. New-Item -Path HKCU:\\Software\\Microsoft -Name 'Exchange' -Force New-ItemProperty -Path HKCU:\\Software\\Microsoft\\Exchange -Name 'AlwaysUseMSOAuthForAutoDiscover' -Value 1 -PropertyType DWORD -Force ``` ![Setting Outlook modern authentication registry entries](https://adamtheautomator.com/wp-content/uploads/2022/07/image-577.png) Setting Outlook modern authentication registry entries > If you’re managing a large pool of Windows computers with Outlook clients, consider deploying the registry items via Group Policy Objects. Related:[Discover What is Group Policy and How it Works (In Detail)](https://adamtheautomator.com/what-is-group-policy/) ### Confirming Outlook Modern Authentication Now it’s time to test whether Outlook uses modern authentication. Open Outlook and log in with your account. After switching to modern authentication, Outlook will ask you to re-authenticate. Press CTRL, right-click the Microsoft Outlook icon in the system tray and click **Connection Status**. ![Opening Outlook connection status](https://adamtheautomator.com/wp-content/uploads/2022/07/image-578.png) Opening Outlook connection status Look at the **Authn** column. The value should be **Bearer**\*, which means Outlook is now using modern authentication with the [OAuth2 Bearer token](https://www.oauth.com/oauth2-servers/differences-between-oauth-1-2/bearer-tokens/). ![Confirming Outlook Authentication method](https://adamtheautomator.com/wp-content/uploads/2022/07/image-579.png) Confirming Outlook Authentication method > _Microsoft 365 Backup For Dummies eBook addresses the data security challenges by outlining the out-of-the-box security features in Microsoft 365. [Get eBook](https://go.veeam.com/office-365-backup-for-dummies?utm_campaign=01BR-M365-GB_Global_EN_0_Custom_WP_dummies-office365&utm_source=adamtheautomator.com&utm_medium=dcm&st=pa&ccode=dcmbloggers)_ ## Conclusion Finally! You’ve finished switching to modern authentication in your Microsoft 365 tenant. You’ve made sure your users are aware of the change by extracting a report of basic authentication. After enabling modern authentication and blocking legacy sign-ins, you’ve verified the changes using Exchange Online PowerShell commands. Finally, you’ve made sure that the Outlook clients are capable of modern authentication. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fmodern-authentication-in-office-365%2F&text=Learn%20How%20to%20Switch%20to%20Modern%20Authentication%20in%20Office%20365)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fmodern-authentication-in-office-365%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fmodern-authentication-in-office-365%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/08/How-to-Automate-with-Microsoft-Azure-RunbooksPractical-Linux-Unix-Tee-Commands-for-the-Linux-Admin-1200-×-675-px.jpg) ### [Azure Runbooks: Your Complete Guide to Automated Solutions](/azure-runbook/) Elevate your automation game with Azure Runbooks: streamline Azure-related tasks efficiently and transform your workflow for maximum productivity. ![](https://adamtheautomator.com/wp-content/uploads/2022/09/Discover-How-to-Use-and-Manage-Azure-Portal.jpg) ### [Discover How to Use and Manage Azure Portal](/manage-azure-portal/) Discover the ins-and-outs to use and manage the Azure Portal and take control of your Microsoft Azure resources! ![](https://adamtheautomator.com/wp-content/uploads/2022/07/Keep-in-Sync-with-Microsoft-Azure-AD-Sync-Password-Writeback.jpg) ### [Keep in Sync with Microsoft Azure AD Sync Password Writeback](/password-writeback/) Discover how to synchronize your Active Directory and Microsoft Azure AD passwords with the password writeback capability! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)