Ensure OAuth 2.0 (modern authentication) is enabled for the organization

VisokaNivo 1Automatskaexchange

Opis

Hybrid Modern Authentication lets Outlook clients use OAuth 2.0 tokens (and therefore MFA and Conditional Access) instead of Basic/NTLM credentials. Run from an Exchange Management Shell or after `Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn`; the audit loads the snap-in itself when Get-ExchangeServer is missing and fails if it cannot.

Kako se proverava

Metod provere: Komanda ljuske

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -ErrorAction Stop }; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { throw 'Exchange Management Shell cmdlets are not available' }; $o = Get-OrganizationConfig -ErrorAction Stop; if ($o.OAuth2ClientProfileEnabled -eq $true) { 'compliant' } else { 'noncompliant' }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

After configuring Hybrid Modern Authentication (EvoSTS auth server and SPN registration), run in the Exchange Management Shell: Set-OrganizationConfig -OAuth2ClientProfileEnabled $true. Test Outlook/ActiveSync clients first.

Svojstva

Operativni sistemi: Bilo koji
Oznake: exchangeauthentication
Referenca: CIS Microsoft Exchange Server Benchmark - Authentication / Modern authentication (verify section number for your release)

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target exchange