Microsoft Exchange Server
TMA-EXCHANGE-MODERN-AUTH
Ensure OAuth 2.0 (modern authentication) is enabled for the organization
Deskripsi
Hybrid Modern Authentication lets Outlook clients use OAuth 2.0 tokens (and therefore MFA and Conditional Access) instead of Basic/NTLM credentials. Run from an Exchange Management Shell or after `Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn`; the audit loads the snap-in itself when Get-ExchangeServer is missing and fails if it cannot.
Cara pemeriksaan
Metode audit: Perintah shell
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -ErrorAction Stop }; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { throw 'Exchange Management Shell cmdlets are not available' }; $o = Get-OrganizationConfig -ErrorAction Stop; if ($o.OAuth2ClientProfileEnabled -eq $true) { 'compliant' } else { 'noncompliant' }- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
After configuring Hybrid Modern Authentication (EvoSTS auth server and SPN registration), run in the Exchange Management Shell: Set-OrganizationConfig -OAuth2ClientProfileEnabled $true. Test Outlook/ActiveSync clients first.
Properti
- Sistem operasi
- Apa saja
- Tag
- exchangeauthentication
- Referensi
- CIS Microsoft Exchange Server Benchmark - Authentication / Modern authentication (verify section number for your release)
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target exchange