SMTP AUTH Exception Smoothens Path to Basic Auth Removal from Exchange Online

Administrators Need to Plan for Change in Clients and Apps

Last week’s announcement that Microsoft will disable basic authentication for Exchange Online connection protocols from October 2022 certainly got people’s attention. Hopefully the message is sinking in that it’s time to prepare for basic authentication to stop working for protocols like POP3, IMAP4, EWS, and ActiveSync. As we’ll discuss later, Microsoft is making an exception for SMTP AUTH, but that’s no excuse not to do the work to make sure a smooth transition occurs. Some tenant administrators and users might be going to receive a terrific surprise when the hammer descends.

Update (September 1): Microsoft is granting tenants the ability to get a three-month extension before retiring basic authentication. See this article for more detail. January 1, 2023 is the new drop-dead date.

Client Upgrades

One good thing to do now is plan for the replacement of old, insecure email clients. Many of the older clients still connecting with POP3 and IMAP4 tend to pass cleartext credentials. Microsoft has upgraded its implementation of POP3 and IMAP4 to support modern authentication, but even so, it’s time to consider the discontinuation of these antiquated protocols. Noble as their service has been to email, the best days for these protocols are long past.

When looking at the replacement options for older clients, including the versions of Outlook due to stop connecting to Exchange Online on November 1, 2021, consider asking people to try OWA. It’s a good client that works well as a progressive web app.

Many people like using the email client included in mobile devices. These clients connect using Exchange ActiveSync (EAS). Some clients support modern authentication with EAS, and some don’t (and will be affected when basic authentication disappears). Outlook Mobile is the obvious replacement. It’s solid, supports more features than EAS will ever do, and is included in Exchange Online licenses.

Applications

The deprecation of basic authentication will impact applications and devices too. Applications should move to the Microsoft authentication platform (MSAL) to achieve “modern” (OAuth-based) authentication. If you’re a PowerShell user, you should connect using the Exchange Online management module instead of traditional Remote PowerShell.

The SMTP AUTH Exception

And then we come to SMTP AUTH. This protocol poses a conundrum for Microsoft. They would very much like to disable it along with the other protocols but if they do, multi-function devices configured to send email using Exchange Online will stop being able to send messages. The same will happen for PowerShell scripts which use the Send-MailMessage cmdlet. This is the reason why Microsoft says: “effective October 1, 2022, we will begin to permanently disable Basic Auth in all tenants, regardless of usage (with the exception of SMTP Auth, which can still be re-enabled after that).”

After checking with Microsoft, here’s what will happen:

• If a tenant has never used SMTP AUTH, Microsoft is already actively blocking the protocol (see my earlier article) by setting the SmtpClientAuthenticationDisabled organization-wide control. Tenant administrators can disable SMTP AUTH for the organization today by running the command:

Set-TransportConfig -SmtpClientAuthenticationDisabled $True

• If a tenant is using SMTP AUTH, Microsoft will not disable the protocol. The presumption is that the organization knows how they use SMTP AUTH and has good business reasons to continue using SMTP AUTH.
• If a tenant discovers that they need to use SMTP AUTH after Microsoft disables the protocol, they can run the Set-TransportConfig cmdlet to update SmtpClientAuthenticationDisabled to $False. However, the big downside in taking this step is that it enables SMTP AUTH across the entire tenant. A per-mailbox setting is available to allow access to SMTP AUTH that overrides the organization configuration. It’s obviously better to limit access to potentially insecure protocols, so it’s recommended that you enable the protocol on a per-mailbox basis to restrict access just to the mailboxes which need to use SMTP AUTH. For example, this command allows the James Smith mailbox to use SMTP AUTH:

Set-CASMailbox -Identity "James.Smith@office365itpros.com -SmtpClientAuthenticationDisabled $False

The End for SMTP AUTH is Nigh, but Not Now

Eventually, I think Microsoft will disable SMTP AUTH permanently for Exchange Online. Granting an exception at this point is sensible because it smoothens the path to the October 1, 2022, target date for disconnecting the other protocols. Let’s face it, statistics and telemetry show that most Microsoft 365 account compromises arise through successful attacks using basic authentication protocols like POP3 and IMAP4. The priority must be to remove these routes routinely exploited by password spray and other attacks. Delaying the deprecation of SMTP AUTH for now buys Microsoft and customers some extra time, but the writing is firmly on the wall that the era of basic authentication for all Exchange Online connectivity protocols is coming to an end.

While working with end users to change their email clients, it would be a great idea to introduce them to the wonders of multi-factor authentication. If you’re going to have disruption in the user community because basic authentication disappears for email, you might as well disrupt users a little more to copper fasten their account security.

---

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.