How to Configure Hybrid Modern Authentication in Exchange On-Premises

Before configuring HMA, confirm your hybrid deployment is properly configured and check current authentication methods. This step ensures you have the foundation needed for modern authentication.

Get-HybridConfiguration | Select-Object Identity, OnPremisesSmartHost, Domains
Get-OrganizationConfig | Select-Object OAuth2ClientProfileEnabled, DefaultAuthenticationPolicy

Check your Exchange version and cumulative update level:

Get-ExchangeServer | Select-Object Name, AdminDisplayVersion, ServerRole

Verify external URLs are configured correctly:

Get-WebServicesVirtualDirectory | Select-Object Server, ExternalUrl
Get-AutodiscoverVirtualDirectory | Select-Object Server, ExternalUrl
Get-OwaVirtualDirectory | Select-Object Server, ExternalUrl

HMA requires your on-premises Exchange URLs to be registered as Service Principal Names (SPNs) in Azure. This allows Microsoft Entra ID to issue tokens for your on-premises services.

First, identify your EvoSTS application in Azure:

Connect-AzureAD
Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Exchange Online'"

Get your current Exchange virtual directory URLs:

$OwaUrl = (Get-OwaVirtualDirectory | Where-Object {$_.ExternalUrl}).ExternalUrl.AbsoluteUri
$EwsUrl = (Get-WebServicesVirtualDirectory | Where-Object {$_.ExternalUrl}).ExternalUrl.AbsoluteUri
$AutodiscoverUrl = (Get-AutodiscoverVirtualDirectory | Where-Object {$_.ExternalUrl}).ExternalUrl.AbsoluteUri

Write-Host "OWA URL: $OwaUrl"
Write-Host "EWS URL: $EwsUrl" 
Write-Host "Autodiscover URL: $AutodiscoverUrl"

Add these URLs as SPNs to the EvoSTS service principal in Azure portal:

1. Navigate to Azure portal > Microsoft Entra ID > Enterprise applications
2. Search for "Microsoft Exchange Online" or "EvoSTS"
3. Select the application and go to Properties
4. Add your Exchange URLs (OWA, EWS, Autodiscover) to the Service Principal Names list

Configure Exchange to use OAuth 2.0 tokens from Microsoft Entra ID instead of basic authentication. This is the core HMA configuration step.

Set the authorization server as the default endpoint:

Get-AuthServer | Where-Object {$_.Name -like "EvoSts*"} | Set-AuthServer -IsDefaultAuthorizationEndpoint $true

Enable OAuth 2.0 client profile for the organization:

Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

For Exchange 2016 CU18+ or Exchange 2019 CU7+, also configure the OAuth inbound proxy:

Set-OrganizationConfig -OAuth2OnPremisesInboundProxyEnabled $true

If you're using OWA, configure the download domains to include your external URL:

$ExternalDomain = ([System.Uri](Get-OwaVirtualDirectory | Where-Object {$_.ExternalUrl}).ExternalUrl).Host
Set-OrganizationConfig -DownloadDomains $ExternalDomain

Reset IIS on all Exchange servers:

Get-ExchangeServer | Where-Object {$_.ServerRole -match "ClientAccess|Mailbox"} | ForEach-Object {Invoke-Command -ComputerName $_.Name -ScriptBlock {iisreset}}

Update your Exchange virtual directories to support modern authentication while disabling legacy authentication methods. This step ensures clients use OAuth tokens instead of basic authentication.

Configure OWA virtual directories for modern authentication:

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -LogonFormat Username -FormsAuthentication $false -BasicAuthEnabled $false -WindowsAuthentication $false -OAuthAuthentication $true

Configure EWS virtual directories:

Get-WebServicesVirtualDirectory | Set-WebServicesVirtualDirectory -BasicAuthEnabled $false -WindowsAuthentication $false -OAuthAuthentication $true

Configure ActiveSync virtual directories (if used):

Get-ActiveSyncVirtualDirectory | Set-ActiveSyncVirtualDirectory -BasicAuthEnabled $false -WindowsAuthentication $false

Configure MAPI virtual directories:

Get-MapiVirtualDirectory | Set-MapiVirtualDirectory -IISAuthenticationMethods @('OAuth')

For Autodiscover, ensure it supports both methods during transition:

Get-AutodiscoverVirtualDirectory | Set-AutodiscoverVirtualDirectory -BasicAuthEnabled $true -WindowsAuthentication $true -OAuthAuthentication $true

Get-OwaVirtualDirectory | Select-Object Server, BasicAuthEnabled, OAuthAuthentication
Get-WebServicesVirtualDirectory | Select-Object Server, BasicAuthEnabled, OAuthAuthentication

Verify that OAuth authentication is working correctly between your on-premises Exchange and Microsoft Entra ID. This step confirms the authentication flow before enabling for production users.

Test OAuth connectivity to EWS:

$TestMailbox = "testuser@yourdomain.com"
$EwsUrl = (Get-WebServicesVirtualDirectory | Where-Object {$_.ExternalUrl}).ExternalUrl.AbsoluteUri
Test-OAuthConnectivity -Service EWS -TargetUri $EwsUrl -Mailbox $TestMailbox -Verbose

Test OAuth connectivity to Autodiscover:

$AutodiscoverUrl = (Get-AutodiscoverVirtualDirectory | Where-Object {$_.ExternalUrl}).ExternalUrl.AbsoluteUri
Test-OAuthConnectivity -Service AutoDiscover -TargetUri $AutodiscoverUrl -Mailbox $TestMailbox -Verbose

Check the authentication server configuration:

Get-AuthServer | Where-Object {$_.Name -like "EvoSts*"} | Select-Object Name, Enabled, IsDefaultAuthorizationEndpoint, AuthMetadataUrl

Verify the organization's OAuth configuration:

Get-OrganizationConfig | Select-Object OAuth2ClientProfileEnabled, OAuth2OnPremisesInboundProxyEnabled, DownloadDomains

Test from a client machine using PowerShell with modern authentication:

$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://yourdomain.com/PowerShell/" -Authentication Basic -Credential $UserCredential -AllowRedirection
Import-PSSession $Session

With HMA enabled, configure Conditional Access policies in Microsoft Entra ID to enforce MFA for on-premises Exchange access. This provides the security benefits that motivated the HMA implementation.

Create a Conditional Access policy in Azure portal:

1. Navigate to Microsoft Entra ID > Security > Conditional Access
2. Click "New policy" and name it "Exchange On-Premises MFA"
3. Under Assignments > Users, select the groups or users who access on-premises Exchange
4. Under Cloud apps or actions > Select apps, choose "Office 365 Exchange Online"
5. Under Conditions > Client apps, select "Exchange ActiveSync clients" and "Other clients"
6. Under Access controls > Grant, select "Grant access" and check "Require multi-factor authentication"

Verify MFA methods are configured for users:

Connect-MsolService
Get-MsolUser -UserPrincipalName "testuser@yourdomain.com" | Select-Object UserPrincipalName, StrongAuthenticationMethods

Test MFA enforcement by connecting to OWA:

Start-Process "https://yourdomain.com/owa"

Configure application-specific passwords for legacy clients if needed:

Set-MsolUser -UserPrincipalName "user@yourdomain.com" -StrongPasswordRequired $true

Monitor authentication in Azure sign-in logs:

1. Go to Microsoft Entra ID > Sign-in logs
2. Filter by Application: "Office 365 Exchange Online"
3. Look for "Legacy authentication" in the Client app column

Complete the HMA implementation by fully disabling legacy authentication methods and validating that all clients are using modern authentication. This step maximizes security benefits.

Disable basic authentication on Autodiscover (final step):

Get-AutodiscoverVirtualDirectory | Set-AutodiscoverVirtualDirectory -BasicAuthEnabled $false -WindowsAuthentication $false

Create an authentication policy to block legacy authentication:

New-AuthenticationPolicy -Name "Block Legacy Auth" -AllowBasicAuthActiveSync:$false -AllowBasicAuthAutodiscover:$false -AllowBasicAuthImap:$false -AllowBasicAuthMapi:$false -AllowBasicAuthOfflineAddressBook:$false -AllowBasicAuthOutlookService:$false -AllowBasicAuthPop:$false -AllowBasicAuthPowershell:$false -AllowBasicAuthReportingWebServices:$false -AllowBasicAuthRest:$false -AllowBasicAuthRpc:$false -AllowBasicAuthSmtp:$false -AllowBasicAuthWebServices:$false

Apply the authentication policy to all mailboxes:

Get-Mailbox -ResultSize Unlimited | Set-Mailbox -AuthenticationPolicy "Block Legacy Auth"

Verify no legacy authentication methods are enabled:

Get-OwaVirtualDirectory | Select-Object Server, BasicAuthEnabled, WindowsAuthentication, OAuthAuthentication
Get-WebServicesVirtualDirectory | Select-Object Server, BasicAuthEnabled, WindowsAuthentication, OAuthAuthentication
Get-ActiveSyncVirtualDirectory | Select-Object Server, BasicAuthEnabled, WindowsAuthentication

Run a comprehensive connectivity test:

$TestUsers = @("user1@yourdomain.com", "user2@yourdomain.com")
foreach ($User in $TestUsers) {
    Write-Host "Testing $User" -ForegroundColor Green
    Test-OAuthConnectivity -Service EWS -TargetUri $EwsUrl -Mailbox $User
    Test-OAuthConnectivity -Service AutoDiscover -TargetUri $AutodiscoverUrl -Mailbox $User
}

Generate a security report showing authentication methods:

Get-Mailbox -ResultSize Unlimited | Select-Object DisplayName, AuthenticationPolicy | Export-Csv "C:\Temp\HMA-Status.csv" -NoTypeInformation