Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Modern authentication in Exchange Online enables authentication features like multifactor authentication (MFA), smart cards, certificate-based authentication (CBA), and non-Microsoft SAML identity providers. Modern authentication is based on the Active Directory Authentication Library (ADAL) and OAuth 2.0.
When you enable modern authentication in Exchange Online, Windows-based Outlook clients that support modern authentication (Outlook 2013 or later) use modern authentication to connect to Exchange Online mailboxes. For more information, see How modern authentication works for Office client apps.
When you disable modern authentication in Exchange Online, Windows-based Outlook clients that support modern authentication use basic authentication to connect to Exchange Online mailboxes. They don't use modern authentication.
Notes:
Since August 2017, Modern authentication is enabled by default in Exchange Online, Microsoft Teams, and SharePoint.
Enabling or disabling modern authentication in Exchange Online as described in this article only affects modern authentication connections by Windows-based Outlook clients that support modern authentication (Outlook 2013 or later).
Enabling or disabling modern authentication in Exchange Online as described in this article does not affect other email clients that support modern authentication (for example, Outlook Mobile, Outlook for Mac 2016, and Exchange ActiveSync in iOS 11 or later). These other email clients always use modern authentication to sign in to Exchange Online mailboxes.
Enabling or disabling modern authentication has no effect on IMAP or POP3 clients. However, you enabled security defaults in your organization, POP3 and IMAP4 are already disabled in Exchange Online. For more information, see Security defaults in Microsoft Entra ID.
When you enable modern authentication in Exchange Online, Windows-based Outlook clients that support modern authentication are prompted to sign in again. Further, the Basic Auth sign in dialog box and the Modern Auth dialog box look very different. See the Outlook and Basic Auth section of the Basic Auth and Exchange Online blog post for details.
A user with multiple accounts configured in their Outlook profile might receive an error when they try to connect to their mailbox. For more information, see Outlook shows "Disconnected" after you enable modern authentication in Microsoft 365
Enable or disable modern authentication in Exchange Online for client connections in Outlook 2013 or later
Using Exchange Online PowerShell
Do one of these steps:
Run the following command to enable modern authentication connections to Exchange Online by Outlook 2013 or later clients:
Set-OrganizationConfig -OAuth2ClientProfileEnabled $trueThe previous command doesn't block or prevent Outlook 2013 or later clients from using basic authentication connections.
Run the following command to prevent modern authentication connections (force the use of basic authentication connections) to Exchange Online by Outlook 2013 or later clients:
Set-OrganizationConfig -OAuth2ClientProfileEnabled $false
To verify the change was successful, run the following command:
Get-OrganizationConfig | Format-Table Name,OAuth* -Auto
Using the Microsoft 365 admin center
In the Microsoft 365 admin center, go to Settings > Org Settings > Modern Authentication. In the Modern authentication flyout that appears, click to enable or disable Turn on modern authentication for Outlook 2013 for Windows and later (recommended).
See also
How modern authentication works for Office 2013 and Office 2016 client apps