Use an Exchange Authentication Policy to Block Email Protocols

Suppressing Password Spray Attacks

Updated: 1 October 2022

Microsoft’s October 17, 2018 announcement of a new method to disable basic authentication for connections to Exchange Online is very welcome. Why? Basic authentication means what it says – a basic mechanism to authenticate a connection to a service. Basic authentication is simple to use and simple to abuse, which is why attackers try to exploit its simplicity in exploits like password spraying attacks and business email compromise. An Exchange authentication policy is a simple and effective way to stop attackers because it blocks attempts to connect to Azure AD accounts before authentication occurs.

Exchange Online supports many different connection protocols from Exchange ActiveSync to POP3 to IMAP4 to MAPI. This is a good thing because it allows people to use their client of choice to connect to their mailbox. Unfortunately, the profusion of connection protocols creates a difficulty too because each must be secured to stop penetration by attackers.

Update: On October 1, 2022, Microsoft entered the final phase of its project to remove basic authentication connectivity for seven email protocols. Organizations that want to protect themselves from drive-by password spray attacks before Microsoft disables basic authentication by deploying an authentication policy to block the protocols most exploited by attackers like IMAP4, POP3, and SMTP. The great advantage of an authentication policy is that it blocks a connection before it gets to Azure AD authentication. Because the policy refuses connections over blocked protocols, attackers never get to test stolen or made-up credentials against a tenant.

Creating an Exchange Authentication Policy

The method now available introduces a new cmdlet set to create and manage protocol authentication policies. Running the New-AuthenticationPolicy cmdlet creates an authentication policy that disables basic authentication for all the protocols supported by Exchange Online. For example:

New-AuthenticationPolicy -Name "No Basic Auth"

RunspaceId : fd030e40-053a-404c-90f9-3cf9f2c2dcef
AllowBasicAuthActiveSync : False
AllowBasicAuthAutodiscover : False
AllowBasicAuthImap : False
AllowBasicAuthLogExport : True
AllowBasicAuthMapi : False
AllowBasicAuthOfflineAddressBook : False
AllowBasicAuthOutlookService : False
AllowBasicAuthPop : False
AllowBasicAuthReportingWebServices : False
AllowBasicAuthRest : False
AllowBasicAuthRpc : False
AllowBasicAuthSmtp : False
AllowBasicAuthWebServices : False
AllowBasicAuthPowershell : False
AdminDisplayName :
ExchangeVersion : 0.20 (15.0.0.0)

The only protocol enabled here is Log Export, which is probably not going to be used by an attacker.

If you don’t want to use PowerShell, you can also manage the default authentication policy through the Microsoft 365 admin center.

Modern Authentication Needed

Before you block basic authentication, you must enable modern authentication for your tenant and be sure that users have clients that support modern authentication, like Outlook 2016. Enabling a block on basic authentication will have an immediate effect on older clients if you’re not careful. See this support article for more details.

Changing Protocol Authentication Settings

If you want to change a setting to allow basic authentication for a protocol, run the Set-AuthenticationPolicy cmdlet. For example:

Set-AuthenticationPolicy -Identity "No Basic Auth" -AllowBasicAuthPop:$True

You can have multiple authentication policies in a tenant, each of which allows basic authentication for different protocols.

Assigning Policies to Users

After you’ve created the authentication policies you need, you assign them to user accounts to tell Exchange Online whether users can connect using basic authentication.

In my tenant, I decided to have a single policy applied to all user accounts and implement the policy immediately, which means that you also reset the baseline for user refresh tokens. This has to be done with PowerShell, so I used a command to find all user mailboxes and use the Set-User cmdlet to assign the authentication policy and reset the refresh token for the account to the current date and time. This will force Exchange to request clients using basic authentication for connections to reauthenticate using modern authentication.

Get-Recipient -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Set-User -AuthenticationPolicy "No Basic Auth" -STSRefreshTokensValidFrom $([System.DateTime]::UtcNow)

Checking Policies Are Applied to Accounts

To check that policies are in place as you intend, check the accounts by running the Get-User cmdlet. As shown below, you should see that each account is assigned the desired authentication policy and the refresh token is reset to the time when the Set-User cmdlet executed.

Get-Recipient -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Get-User | Format-Table
DisplayName, AuthenticationPolicy, Sts*

DisplayName   AuthenticationPolicy StsRefreshTokensValidFrom
-----------   -------------------- -------------------------
Deirdre Smith No Basic Auth        18 Oct 2018 14:30:42
Tony Redmond  No Basic Auth        18 Oct 2018 14:31:06
TempAdminAC   No Basic Auth        18 Oct 2018 14:31:11

Defining a Default Protocol Authentication Policy

New user accounts are assigned the default protocol authentication policy for the tenant. Unless you define a default protocol authentication policy in the organization configuration, the value assigned to new accounts is $Null, meaning that no policy is assigned. To change this, run the Set-OrganizationConfig cmdlet and define a new default:

Set-OrganizationConfig -DefaultAuthenticationPolicy "No Basic Auth"

You can check the value with the Get-OrganizationConfig cmdlet:

Get-OrganizationConfig | fl DefaultAuthenticationPolicy

DefaultAuthenticationPolicy : No Basic Auth

All Good So Far

The block on basic authentication has been in place in my tenant for a few days now and no problems have been seen so far. Apart from finding out whether people use obsolete clients to connect to mailboxes, the biggest issue you might face is that disabling basic authentication for PowerShell forces accounts to use multi-factor authentication when they connect to Exchange Online.

If a problem was encountered, it’s easily fixed by reversing course and either removing the authentication policy from the affected user accounts or allowing basic authentication for a specific protocol. To remove a policy, run Set-User again:

Set-User -Identity "John Smith" -AuthenticationPolicy $Null

No events are recorded in the Office 365 Audit Log to show that someone’s account was blocked for basic authentication. But this is a preview that’s designed to show customers what’s coming down the tracks and it’s likely that Microsoft will improve this aspect of the implementation when protocol authentication policies are generally available.

Limiting basic authentication for connections using a protocol policy only affects Exchange Online and has no influence over any other Office 365 workload.

---

Exchange Online is covered in Chapter 5 of the Office 365 for IT Pros eBook. Then again, Exchange is used by many Office 365 applications, so it turns up throughout the book.