What this check looks at
Checks in Exchange Online that modern authentication (OAuth 2.0) is on for Outlook clients.
Modern authentication (OAuth 2.0) is how Outlook signs in to Exchange Online through Microsoft Entra ID, and it is what lets MFA, Conditional Access and sign-in risk apply to mail. The OAuth2ClientProfileEnabled setting in Exchange Online’s organisation configuration tells Outlook for Windows to use it. It has been on by default for tenants created since 2017, but older tenants can still have it off, and it is sometimes switched off to work round a client problem.
The check reads OAuth2ClientProfileEnabled from Exchange Online and passes when it is on, fails when it is off.
With it off, Outlook for Windows does not use modern authentication against Exchange Online. Before Microsoft retired basic authentication for Exchange Online, that meant every Outlook sign-in was a password alone, untouched by MFA or Conditional Access. Today it mostly shows up as repeated password prompts and failed connections, which people work round with other mail apps the organisation controls less well.
Why it matters
Without modern authentication, Outlook signs in with a password alone and cannot do MFA or Conditional Access, so every protection on sign-in is skipped for mail.
Password spraying against Exchange Online was for years the commonest way into small business tenants, because Outlook’s basic sign-in skipped MFA. Microsoft has since retired basic authentication for Exchange Online, but a tenant with modern authentication off for Outlook is out of line with that change, and its users are the ones who see the sign-in problems.
Turning it on costs nothing for any supported version of Outlook and puts every Outlook sign-in under the same MFA and Conditional Access policies as the rest of Microsoft 365. Only Outlook 2010 and earlier cannot use it, and those versions have long been out of support.
CIS Microsoft 365 Foundations Benchmark 6.5.1 asks for modern authentication for Exchange Online. Cyber Essentials requires MFA on cloud services, which Outlook can only satisfy through modern authentication. NIST CSF 2.0 PR.AA-03, ISO 27001 A.8.5 (secure authentication), CIS Controls v8 6.3 and NCSC CAF B2.a cover the same requirement.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Modern authentication
Before you start
- Check for Outlook 2010 or older (sign-in logs, client app "Other clients"), which cannot use modern authentication.
Step by step
- Check for very old Outlook versions. In the Microsoft Entra admin centre, go to Entra ID > Monitoring & health > Sign-in logs, filter Client app to the legacy authentication clients and look for Exchange or Outlook sign-ins. Anyone still on Outlook 2010 or earlier needs a supported version before or straight after the change.
- Turn it on in the Microsoft 365 admin centre. In the Microsoft 365 admin centre, go to Settings > Org settings, select Modern authentication on the Services tab, tick Turn on modern authentication for Outlook 2013 for Windows and later and select Save.
- Or turn it on in PowerShell. Connect with Connect-ExchangeOnline and run Set-OrganizationConfig -OAuth2ClientProfileEnabled $true. The setting applies to the whole organisation.
- Restart Outlook on a test machine. Close and reopen Outlook on one PC. It should show the Microsoft sign-in window, with MFA where policy requires it, rather than a basic password box. The change can take a while to reach every client, and people may need to restart Outlook once.
- Confirm the setting. Run Get-OrganizationConfig | Format-List OAuth2ClientProfileEnabled and check it is True. In the sign-in logs, Outlook sign-ins should now show the client app as Mobile apps and desktop clients. The next assessment passes.
With PowerShell
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
What users will notice
Outlook signs in with modern authentication, so MFA and Conditional Access apply. Very old Outlook versions may ask for a password again.
How to confirm it worked
Get-OrganizationConfig shows OAuth2ClientProfileEnabled as True.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Multi-factor authentication test on cloud services |
| NCSC CAF | B2.a Identity verification, authentication and authorisationB4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9(4)(d) Strong authentication mechanisms |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.4.3 MFA for all remote network access2.2.4 Only necessary services, protocols and functions are enabled |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication3.4.6 Employ the principle of least functionality |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor AuthenticationCM.L2-3.4.6 Least Functionality |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CIS M365 | 6.5.1 Ensure modern authentication for Exchange Online is enabled |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1)4.8 Uninstall or disable unnecessary services on enterprise assets and software (IG2) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Enable or disable modern authentication for Outlook in Exchange Online (Microsoft Learn)