Back to Checks
m365

Organization has Modern Authentication enabled

exchange_organization_modern_authentication_enabled
Service: exchangeSeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Microsoft 365 Exchange Online organization setting determines if Modern Authentication (OAuth 2.0) is enabled for client connections.

This evaluates whether clients use token-based sign-in rather than Basic credentials.

Prowler logoProwlerprowler-provider-m365

Risk

Without Modern Authentication, clients may fall back to Basic, disabling MFA and enabling password spraying and credential stuffing. Account takeover can expose mailboxes, alter rules, and send fraudulent emails, harming confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_organization_modern_authentication_enabled

Recommendation

Enable Modern Authentication org-wide and phase out Basic to enforce token-based access. Require MFA with conditional access, block legacy mail protocols where feasible, and apply least privilege on mailbox permissions. Monitor sign-ins for legacy usage to maintain defense in depth.

Remediation

CLI

Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

Other

1Sign in to the Microsoft 365 admin center
2Go to Settings > Org settings > Modern authentication
3Enable "Turn on modern authentication for Outlook 2013 for Windows and later"
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_organization_modern_authentication_enabled(Check):
    """
    Check if Modern Authentication is enabled for Exchange Online.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the check for Modern Authentication in Exchange Online.

        This method checks if Modern Authentication is enabled in the Exchange organization configuration.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        organization_config = exchange_client.organization_config
        if organization_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=organization_config,
                resource_name=organization_config.name,
                resource_id=organization_config.guid,
            )
            report.status = "FAIL"
            report.status_extended = (
                "Modern Authentication is not enabled for Exchange Online."
            )

            if organization_config.oauth_enabled:
                report.status = "PASS"
                report.status_extended = (
                    "Modern Authentication is enabled for Exchange Online."
                )

            findings.append(report)

        return findings

References