So how do you know if your (Outlook) client is using Basic Authentication or Modern Authentication? The authentication popup when Outlook 2016 shows when using Basic Authentication looks like this: This can include Exchange Online, SharePoint Online, OneDrive for Business, Azure resources, etc. Azure AD creates a token and the client uses this token to access other resources in the Microsoft cloud. A client reaches a logon page (from Azure AD) and enters his/her credentials. In Office 2013, Microsoft introduced a new way of authentication called Modern Authentication, which is token-based.

When users are using weak passwords (admit it, they do) it is just a matter of time before their account is compromised.

Basic authentication is vulnerable to brute force or password spray attacks. Every time a resource is accessed, the username and password are sent across the wire, over and over again. The connection is secured by SSL so traffic is unreadable. When using Basic Authentication, the username and password are sent in clear text across the wire.

However, most customers don’t have this and may run into issues. īut what does that mean? If you have the latest version of Microsoft software and everything configured according to Microsoft best practices you should be good. In addition, Microsoft will stop basic authentication in Office 365 as outlined in their post Upcoming changes to Exchange Web Services (EWS) API for Office 365 and their follow-up post Basic Auth and Exchange Online – February 2020 Update. On this date, Microsoft will stop support for their 2010 suite of products like Exchange 2010, SharePoint 2010, Office 2010, etc. October 13, 2020, is an important date for Microsoft for a variety of reasons.

Office 365 legacy authentication