Microsoft 365 Community Community Demos, 14 Jun 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Latest on deprecating basic auth for Exchange

Description

In this 13-minute developer focused demo – Greg Taylor relates an impactful change to be aware. Beginning October 1, 2022, Microsoft will start to turn off Basic Auth for several mail protocols. Fortunately, the protocols all support modern OAuth today. Understand where to look for usage data, tips for interpreting the data (based on protocol), next steps check list, and Useful Links. Note: Microsoft is not turning off the protocols themselves and if shutoff but requirement in tenant, Basic Auth can be switched on, will be supported. This PnP Community demo is taken from the weekly Microsoft 365 Platform Community call recorded on June 14, 2022.

Demo Presenter
• Greg Taylor (Microsoft) | gregtaylor_msft

Supporting materials
• Documentation - Deprecation of Basic authentication in Exchange Online | https://docs.microsoft.com/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online
• Article - Basic Authentication and Exchange Online – September 2021 Update | https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-september-2021-update/ba-p/2772210
• Documentation - How modern authentication works for Office 2013, Office 2016, and Office 2019 client apps | https://docs.microsoft.com/microsoft-365/enterprise/modern-auth-for-office-2013-and-2016?view=o365-worldwide
• Article – Enabling Modern Auth for Outlook – How Hard Can It Be? | https://techcommunity.microsoft.com/t5/exchange-team-blog/enabling-modern-auth-for-outlook-how-hard-can-it-be/ba-p/2278411
• Documentation – About the Exchange Online PowerShell V2 module | https://docs.microsoft.com/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps
• Documentation – Connect to Security & Compliance PowerShell | https://docs.microsoft.com/powershell/exchange/connect-to-scc-powershell?view=exchange-ps
• Documentation – Exchange Online and Exchange development | https://docs.microsoft.com/exchange/client-developer/exchange-server-development
• Documentation – Authentication and EWS in Exchange | https://docs.microsoft.com/exchange/client-developer/exchange-web-services/authentication-and-ews-in-exchange
• Documentation – Microsoft identity platform and OAuth 2.0 authorization code flow | https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow
• Documentation – Authentication flow support in MSAL | https://docs.microsoft.com/azure/active-directory/develop/msal-authentication-flows
• Repo - Using MSAL in the EWS Managed API and doing auto token expiration and renewal in Delegate and Client Credential Azure oAuth Flows | https://github.com/gscales/EWS-BasicToOAuth-Info/blob/main/EWA%20Managed%20API%20MASL%20Token%20Refresh.md
• Documentation – Authenticate an IMAP, POP or SMTP connection using OAuth | https://docs.microsoft.com/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community

A

Hi everyone uh thank you for letting me come and have the opportunity to talk about something rather important that we're doing with uh basic author exchange online, something that involves customers, developers, partners, everybody, it's a fairly uh impactful change and, frankly, as much help as we can get from everyone, the better. So I'm greg taylor, I'm a product manager in m365 core, I'm focused on exchange and security, and what I want to briefly try and walk through with this audience today is a reminder of hopefully you're aware of what we're doing basically, author exchange online.

A

If not, this will be a a brief summary um how we are telling customers to go, find the usage that they have and uh what they, what it means, what they're gonna do about it and then there's a bunch of useful links as well, so I'm gonna run through as quickly as I can happy to follow up with questions in the chat or wherever.

A

Okay, so is the. uh Is there the real lowdown so, beginning october, 1st 2022, we are going to start to turn off basic all for a number of protocols for eight different protocols.

A

I'm going to highlight a few key words because some of the communication customers, however, clearly put it some customers will interpret it to mean something different. So I'm going to say the word beginning october 1st, we will begin to turn off basic author as a number of protocols. That means we will not turn everyone off on october 1st. That would be a pretty awful day to work in microsoft. Support if that were the case, um we're also not turning off the protocols themselves.

A

Just be super clear on that active sync, as a great example keeps coming up. People keep asking so you're turning off active sync, no we're turning off basic auth for exchange activities, so those iphones and on android will continue to work, but they just can't use basic all so we're turning off pop and imap. You may or may not be surprised. There are still a lot of people using pop and imap, primarily applications, not really client.

A

You know client day-to-day usage for email, but there is still quite a lot of that going on then we're turning off um the protocols that outlook uses, mapping, rpc offline, address book and exchange web services exchange web services, as I'm sure many of you know, is also used by a lot of different applications for all kinds of reasons, so that will be impacted too active sync I already mentioned, and then remote powershot so, like I said we're not turning off the protocols, we're turning off basic auth and all of these protocols already support oauth, modern north now.

A

Another thing that we announced we were going to do would be. We would interrupt basic auth for customers uh between now and october. As we rolled this out, I will tell you that that's primarily focused at the smb end of the market smb and edu customers, primarily smb customers, they're, not the ones that read the message center. They don't read the blogs, they don't hang on. Every word I put out on basic auth, so there will be some interruptions of service. There are ways customers can go and opt out of that read the documentation.

A

There's a link on here, but there's also notes in the blogs and the message center posts where, if a customer can go in and say, please don't touch basic author, I'm at, I still need it don't mess around and if we do go and turn it off for 48 hours as soon as they notice, they can actually go in to the admin center and turn it back on within 15 minutes, it'll be back on again, so it's a rolling interruption of service, something we haven't really done before and yes paul, you might call it a screen test.

A

We are doing it quite a few customers at the moment and I'm hearing a few screams and that's okay right customers can turn it back on again after october, though that's it, okay, so um the other one I want to really call out as well is smtp auth used for sending mail outbound. We have already turned off smtp all for customers that don't use it basic auth and we've turned it off for millions of tenants. I'll tell you all right.

A

We turned off basic basically for millions of tests right now who don't use it, but for whom it was enabled, so we're actually protecting customers by turning it off but smtp. If it is still in use, we are not going to touch it even if we turn it off. You can turn smtp back on and the main reason for that is, there are a ton of devices and- and you know, hardware devices that really can't be updated to support our flows, so we will allow smtp auth for the foreseeable future.

A

We have no plans to turn that off. So the question that most customers ask is how do I know if I'm using basic author so there's a couple of places. I want to point you to so one. Is: we've been sending message center posts to all the tenants who use basic auth every month since about october last year? It is the mother of all male mergers. Think of it like that.

A

We send a customized per tenant message center post to every tenant, using basic auth, with a summary of using this much imap, and this much pop and everything else.

A

I will say it's indicative: it's not precise numbers, it's indicative, because if you think about something like exchange web services, it's used by applications, it's used by outlook for windows for mac, it's a little hard to be precise. Exactly how many users in any particular time are using. You know specific applications at our level at an aggregate level.

A

However, if you want the, uh if you want the detail, then azure ad signing reports is really the place. A customer or partner. Whomever can go, find the detail so message center posts are about. I know, there's basic auth usage. Azure id reports are about who's, the user. What's the ip address, what's the machine name and so on and so forth? That's really where you find the detail. There's a filter in the client app settings in the azure id signing reports.

A

You want everything under legacy, but if you're a large customer there is a link as well, because the the report there will um will will not be very easy to download if you're a large customer with a lot of usage- and you might want to use android workbooks or something like that. Instead stream it to log analytics now, when you get all of this data, when a customer gets all of this data, then it's like work out. What do I do now? Well, the first thing is: get the data exported in json format.

A

If you are downloading not csv, because json format will give you all the user agent strings and user agent strings while not obviously, 100 infallible are very useful to help customers identify what the usage is and where it's coming from. If I were to write a bad app, I probably wouldn't create a user agent string of my evil app version 1.0. I would probably try and hide it so user agent strings are not infallible, but for most customers, they're incredibly useful.

A

So here's I'm going to run through a couple of kind of suggestions for how we typically suggest customers go and interpret the data we'll go protocol by protocol. So, let's start with active sync: if you have got a base bunch of basic auth usage with active sync, what do you do?

A

Well, if you're a large customer, you probably have an mdm, but if you have an mdm solution, you need to use it to change the profile to change the authentication type now apple's mdm api, for example, does not allow you to modify the auth type of an existing profile.

A

You have to create a new profile, tell it to use or push it to the device, meaning the device will then have to resync mail, but you can use the ndm intune can do it workspace one can do it all of those can do it so push a new profile using oauth and not basic auth. If there isn't an mdm, there is something I was hoping to talk about on the call. It's not quite ready yet been working with apple and google on some stuff, but we'll hopefully have something public on that fairly soon.

A

But the most practical solution for users is remove the account from the device and add it back. That sounds rather rubbish. I know um the native mail app on an iphone has supported a wall for two years or more. Why is it still using basic auth? Because there are a lot well, it's using basic authors, because the user had their first iphone more than two years ago. They configured their email. It was using basic auth. They then went to the apple store or wherever and got themselves a new iphone shiny, new iphone.

A

The first thing it says is you want me to transfer your data and settings you're like well. That sounds like a good idea. I should do that. All the pictures of your family and your cats and everything come across and all your settings, which include the authentication type used for the mail app so we'll keep using basic, even though it's the newest iphone so remove the account. Add it back.

A

Okay, um certificate based off I'll call. This out is not basic auth certificate based auth, if you're, using that for active sync, will show up under legacy off in the azure id signing reports, but it is not going to be effective when we turn off basic or slightly confusing we're trying to clarify and actually have a call today to try and get some of this clarified in in our documentation.

A

Okay, jumping forward uh outlook for windows, there's a variety of protocols being used biggest flag at the top here. Is this oauth 2 client profile enabled flag? Is a per tenant flag users get organization config set organization config? If that flag is set to false output windows cannot do modern auth, it is told not to it's. Only outlook for windows- that's affected by this particular switch. Make sure you a tenant has the flag set to true out for windows can do modern auth.

A

Now, when you look through user agent strings, then there's that the user agent string will tell you what version of outlook is in play by whether it has a 14, 15 or 16 in it. If there's a 14, it's out of 2010 and yeah people are still using outlet. 2010, okay and uh 15 is out with 2013 needs. A registry. Key, though, can do modern.

A

North 16 should be doing modern north, and so, if you see 16 in there somebody's done something, that's it should be doing modern north and it's not either the flag is set in the tenant to be false or they've gone and pushed out some kind of policy people falling asleep to my voice. I don't know if that's a good thing or a bad thing, all right I'll, keep plugging on regardless. Sorry, if I'm losing your audience brian investor right so ews, this one's a bit tricky another lots of developers.

A

There's a ton of apps out there still using baseball the user agent strings are mostly helpful. Python requests 2.26.0 is not very helpful. Customers are discovering applications that are using basic auth. They need help from um they're going to need help from developers partners um everybody to figure out um what they're going to do to remediate. The app ews can do oauth clearly graph would be a preferential way to go, but this is the time to redevelop your app from ews to graph, probably a little late.

A

That should be more of a strategic goal rather than a tactical goal. I've called out a couple of things in here as well. If you see user agent strings from surface hubs and from teams rooms, the teams rooms devices are using basic auth. There are updates coming from the teams team, but you can go in the team's admin center or the admin console and change the device to use mod north very quickly and easily. Customers need to do that or they are going to get cut off pop imap and powershot.

A

Believe it or not, there's still quite a lot there going on. There are no user agent strings in the protocol, so we have no idea what the client app is that's being used. I know there's a lot of applications that are using them. They all or all of these uh protocols, support modernist flows, client credential flow for pop and imap will be out very very soon for non-interactive flows, but for client, apps and in any kind of app that supports an interactive flow code is already there.

A

People are going to need help so make sure customers look in the message center. Then they know if they have a problem or not use the azure id sign reports to get the detail figure out what to do with the users communicate to the users. There's a great example of how one of the edu's has has taken the data from azure id signing reports and they pop it into user portal.

A

These are the devices you use that are going to get cut off, keep make sure that the email, clients and stuff are up to date for pop and imap, maybe outlook on the web. I would rather not use outlook on the web day to day I live in outlook, but many users will put up and be very happy with the current versions of owa and uh let's try and get secure.

A

So um my last slide here is: there's a bunch of informational links, I'll leave it at that it pros stuff at the top developer focus stuff at the bottom, any help you can all give to get our customers secure enough basic auth. I will be eternally grateful, as will they.

B

Excellent, thank you so much greg a very useful information and we hope that everyone does pay attention. uh These dates are coming fast and we would like people to definitely make sure that they're prepared and ready for this once the cutoff date hits.