MT.1044 - Ensure modern authentication for Exchange Online is enabled
Overview
Modern authentication for Exchange Online MUST be enabled
Rationale: Modern authentication enables enhanced security features like multifactor authentication (MFA), certificate-based authentication (CBA), and third-party SAML identity providers. Without modern authentication, users are more vulnerable to password-based attacks.
Remediation action
- Connect to Exchange Online:
Connect-ExchangeOnline
- Enable modern authentication:
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
- Verify the setting:
(Get-OrganizationConfig).OAuth2ClientProfileEnabled
The result should be True.
Related links
- Enable or disable modern authentication in Exchange Online
- Modern authentication overview
- Microsoft Secure Score - Enable modern authentication
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1044 |
| Severity | Low |
| Suite | Maester |
| Product | Exchange Online |
| Feature | Client access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force |
| PowerShell test | Test-MtExoModernAuth |
| Services | ExchangeOnline |
Source
- Test:
tests/maester/exchange/Test.MT.1044.ps1 - Documentation:
tests/maester/exchange/Test.MT.1044.md