Shulou(Shulou.com)11/24 Report--

CTOnews.com September 29 news, Microsoft recently issued a final reminder: it has been notified several times in the Microsoft 365Administration Center that for the international version of Microsoft 365, the product group will disable basic authentication (Basic Auth) for Exchange Online on 2022-10-1. Please tell each other and make sure measures are taken. Please refer here. If no action is taken, the possible impact is that some users are unable to connect to the mailbox.

It's too late, please refer to here to apply for the last extension (no further extension after 2023-1-1).

Why disable basic authentication? Technically, basic authentication (also known as legacy authentication) is a HTTP-based authentication scheme. When an application initiates each connection request to a server, service, or API node, it sends a user name and password at the same time, and saves these credentials on the device. This approach greatly simplifies the authentication process, but it is an ideal hunting target in the face of the various means of the attacker! Especially without the protection of TLS, they can easily steal the identity of users.

In terms of operation and maintenance, basic authentication is easy to configure, but it also makes it more complex and difficult to deploy multiple authentication.

As a result, Microsoft decided to gradually turn off basic authentication for users using Exchange Online worldwide from October 1, 2022, and replace it with more advanced modern authentication. This will help the majority of users to better safeguard their own interests and improve the security of enterprises and users. Since September 2021, Microsoft has continued to issue reminders (MC345821) through its official website and the "message center" in the management center, and will continue to provide monthly "message center" reminders to customers who still use basic authentication. Please be prepared in advance.

The detailed official schedule is as follows for tenants who do not use basic authentication:

-starting from June 2021, tenants who have not yet used basic authentication will gradually receive notification in the message center that basic authentication will be turned off for that tenant 30 days later, and will be notified again after the closure is completed.

For tenants who are using basic authentication:

-starting from September 2021, multiple reminders will be received in the message center to instruct tenant administrators to take relevant actions.

-starting from October 1, 2022, basic authentication will be permanently disabled for all tenants who have used basic authentication, and the deactivation process for all tenants will be completed one after another. Microsoft will issue another warning through the message center seven days before the shutdown, issue a service health dashboard notification, and then turn off basic authentication. After that, you cannot apply for an exception in any form.

-tenants using the Office 365 service operated by Century Interconnection will completely turn off basic authentication from March 31, 2023, after which you cannot apply for an exception in any form.

Possible impact and its scope

Microsoft will turn off basic authentication for the following protocols: Exchange ActiveSync (EAS), POP, IMAP, Remote PowerShell, Exchange Web Services (EWS), Offline Address Book (OAB), Outlook for Windows / Mac. (for tenants who have not yet used SMTP AUTH, SMTP AUTH will also be closed)

CTOnews.com understands that after shutdown, any clients (user applications, scripts, integrations, etc.) that use basic authentication for the above affected protocols will not be able to connect to Exchange Online. The application will receive a message such as "HTTP 401 error: wrong username or password".

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.