Microsoft has been clear enough for anyone listening: basic authentication for Exchange Online protocols is on a deprecation path. Modern authentication (OAuth-based sign-in for Outlook, ActiveSync, IMAP, POP, and related endpoints) is the destination. The organizations that will hurt are not the ones reading roadmap blogs in October 2019 — they are the ones who discover their HVAC vendor’s mail relay, a thousand Android devices on basic auth, or a service account embedded in a line-of-business app the week enforcement lands.
This post is how we inventory basic-auth usage now, how we stage enforcement without locking out the CEO’s phone, and what “migration” means when the workload is protocols rather than mailboxes.
Why this is a security project wearing a messaging hat
Basic auth sends passwords (or equivalents) in patterns that enable password spray and legacy protocol abuse. Disabling it is one of the highest-leverage identity hygiene moves available in an Office 365 tenant — comparable to turning off legacy authentication at the Conditional Access layer for other apps.
Treat it as tier-0 identity work, not as an Exchange footer in someone else’s project plan.
Discovery: you cannot disable what you cannot see
We pull multiple signals:
- Azure AD sign-in logs filtered for Exchange Online / legacy client types and basic auth patterns (the portal and Graph/reporting paths available to you in your license tier).
- Exchange Online reports for protocols still in use (IMAP, POP, authenticated SMTP, Exchange ActiveSync).
- Device and ActiveSync partnership inventories — which devices, which users, last success.
- Service accounts that never appear in “user education” plans: scanners, multi-function printers, line-of-business apps, Linux cron jobs, backup tools, notification systems.
- On-premises relays and hybrid paths that still present credentials in old ways.
Expect the inventory to be ugly. That is the point. One healthcare client found more basic-auth volume from a single lab system account than from an entire department of humans.
Categories of remediation
| Category | Typical fix | Difficulty |
|---|---|---|
| Outlook desktop / mobile on supported builds | Ensure modern auth enabled; rebuild profiles if sticky | Low |
| ActiveSync devices on old OS | OS/app upgrade or replace device | Medium |
| IMAP/POP humans | Move to Outlook/modern clients; disable protocols when empty | Medium |
| Multifunction printers / scanners | Vendor modern auth support, OAuth device flows if available, or controlled relay | High |
| LOB apps and scripts | Code change, app passwords only as temporary bridge where still allowed, then OAuth | High |
| SMTP AUTH relays | Move to authenticated modern patterns or proper relay architecture | High |
App passwords and temporary exceptions are bridges with expiry dates, not architecture.
Staged enforcement (do not big-bang)
Our usual sequence:
- Report-only / monitoring — quantify who would break
- Block basic auth for protocols with near-zero usage first (often POP before ActiveSync)
- Pilot CA policies that block legacy auth for a pilot group
- Expand rings by department or risk tier
- Service account war room — dedicated owners for non-human identities
- Tenant-wide block with break-glass process documented
Conditional Access “block legacy authentication” is a primary tool when licenses allow. Combine with Exchange protocol auth policies where available so messaging and identity controls agree.
Hybrid estates
On-premises Exchange and hybrid free/busy do not excuse leaving basic auth open to Exchange Online from the internet. Segment:
- What must remain for on-prem protocols internally
- What hits Exchange Online from the world
Publish Outlook Anywhere / ActiveSync guidance for hybrid users carefully so you do not “fix” cloud security by reopening basic auth for everyone.
Break-glass and exceptions
You need:
- Named exception process with security sign-off and thirty-day reviews
- Break-glass admin accounts excluded carefully (and monitored)
- Communications templates for “your phone stopped getting mail” that include the real fix, not only reboot steps
If every executive exception is permanent, you did not enforce modern auth — you performed theater.
Timeline honesty
Microsoft’s published dates have moved before; design as if enforcement is sooner than the most optimistic slide. Inventory in 2019. Remediate service accounts in 2019–2020. Do not schedule discovery for the month of enforcement.
What we tell clients this month
- Pull sign-in and protocol reports this week
- Build a service-account owner list before user education campaigns
- Pilot legacy-auth blocking on IT and one friendly business unit
- Fund LOB remediation as a project, not a helpdesk ticket type
SMTP AUTH and the printer problem
Authenticated SMTP used by scanners and LOB mailers is a frequent last holdout. Options, in order of preference:
- Vendor supports OAuth / modern patterns — implement
- Central relay with controlled IP allow lists and modern backend submission
- Temporary exception with expiry and owner
- Disable the feature and accept business noise
Never leave SMTP AUTH open broadly to the internet as a convenience.
User communication sample themes
- What is changing (password-based mail apps stop working)
- Which apps are supported
- What to do on iOS/Android (remove/re-add account, store type)
- Who to call if a shared mailbox workflow breaks
- Deadline dates for each ring
Technical enforcement without communication is just an unplanned outage with better graphs.
If you're facing this
If your plan for basic auth deprecation is “users will upgrade Outlook eventually,” you will meet the deadline through an outage. We inventory legacy protocol usage and design staged Conditional Access / protocol enforcement for Office 365 tenants — bring admin access to sign-in logs and a willingness to name owners for non-human accounts.