Check ID: exchange_organization_modern_authentication_enabled
Provider: Microsoft 365
Service: exchange
Severity: CRITICAL
Categories: identity-access
Resource type: NotDefined

​
What this check verifies

Microsoft 365 Exchange Online organization setting determines if Modern Authentication (OAuth 2.0) is enabled for client connections. This evaluates whether clients use token-based sign-in rather than Basic credentials.

​
Risk

Without Modern Authentication, clients may fall back to Basic, disabling MFA and enabling password spraying and credential stuffing. Account takeover can expose mailboxes, alter rules, and send fraudulent emails, harming confidentiality and integrity.

​
Recommendation

Enable Modern Authentication org-wide and phase out Basic to enforce token-based access. Require MFA with conditional access, block legacy mail protocols where feasible, and apply least privilege on mailbox permissions. Monitor sign-ins for legacy usage to maintain defense in depth.

​
Remediation

Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = exchange_organization_modern_authentication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks