Manage recipient access and authentication
Domain 7 - Manage recipient access and authentication
This domain tests how clients authenticate and connect: modern authentication, OAuth, MFA, Conditional Access, authentication policies, client access rules, OWA and ActiveSync policies, and legacy protocol controls.
Core rules
- Modern authentication uses OAuth and supports MFA and Conditional Access. Legacy basic authentication sends credentials with each request and should be blocked unless a specific application requires it.
- Authentication policies in Exchange Online can allow or block basic authentication per protocol, including ActiveSync, EWS, IMAP, POP, and OWA. SMTP AUTH is controlled separately with the mailbox's SMTP client authentication setting.
- Client access rules evaluate connection properties such as IP address, protocol, and user; they are not an authentication mechanism and do not replace MFA.
- OWA mailbox policies control features such as attachments, calendar sharing, and text messaging. ActiveSync policies control device PIN, encryption, and attachment download.
Worked example
An organization must block legacy authentication but allow one multifunction device to send mail through SMTP AUTH. Create an authentication policy that blocks basic authentication for ActiveSync, EWS, IMAP, POP, and OWA, and assign it to all users. Leave SMTP AUTH disabled tenant-wide, then enable it only on the device's service mailbox with Set-CASMailbox -SmtpClientAuthenticationDisabled $false. Reasoning: the authentication policy does not govern SMTP AUTH, so the mailbox setting is required. Confirm with sign-in logs and a test SMTP submission.
Traps
- Blocking basic authentication does not automatically block SMTP AUTH.
- Conditional Access requires modern authentication; legacy clients fail before policy evaluation.
- App passwords bypass MFA expectations and should be restricted.