If you haven’t heard, Modern Authentication (aka ADAL), has now officially gone GA (https://blogs.office.com/2015/11/19/updated-office-365-modern-authentication-public-preview/) – which means that if you are utilising Office 365 services, particularly Exchange Online, and Office 2013/2016 as your client, you should really be looking at enabling this functionality for your end users.
For those unfamiliar with Modern Auth, there are numerous benefits, but one of the most obvious for end users is it removes the need for the use of ‘save my credentials’ when signing into Exchange Online and provides a true SSO experience when combined with ADFS Federation.
Now, the process for enabling Modern Auth is very well documented in the above blog post, but the short version is:
- Enable Modern Auth on the Tenant side via a powershell command
- Enable Modern Auth on the client side via a registry key
What isn’t explicity called out as a pre-requisite however is that your Outlook client also needs to also be running in MAPI over HTTP mode. Now, for a large percentage of environments, this is probably not an issue – but if you are like a recent customer of ours, you may have specifically disabled the use of MAPI-HTTP. Now there are a number of valid reasons of why you might have wanted to do this (theirs was they were using an old version of Riverbed that didn’t support optimization using the MAPI-HTTP protocol), but as it turns out, the introduction of the MAPI over HTTP protocol to replace the legacy ‘RPC over HTTP’ protocol over 3 years ago was actually one of the precursors into allowing all this fancy Modern Authentication stuff to work.
For full details around what MAPI-HTTP protocol brought in and the benefits it introduced, I recommend reading this great blog post from the Microsoft Exchange team.
But in short, if you find that you have enabled Modern Auth as per the described steps, and you’re still getting the ‘basic auth prompt’ – I’d go ahead and check to see if the following registry key has been set (via GPO or otherwise)
Key: HKEY_CURRENT_USER\Software\Microsoft\Exchange DWORD: MapiHttpDisabled Value: 1
The above needs to either be deleted, or set to ‘0’ in order for Modern Auth to work. The support article KB2937684 also gives you some more info around ensuring MAPI-HTTP is enabled for your Office 2013/2016 client.
Note that changing this value does not take effect until the client next performs an ‘autodiscover’ to switch over. Depending on the situation, this may cause the user to see the following pop up:
Generally speaking, I’d recommend you test the registry update first with a subset of pilot users, before rolling this out to the wider audience. Once that is confirmed working, then you can look at rolling out Modern Auth to your end users.