Microsoft Adds OAuth Support to Exchange Online Mailbox Migrations

Organizations migrating mailboxes between on-premises Exchange and Microsoft 365 have traditionally relied on Basic Authentication, which requires storing and transmitting privileged Active Directory usernames and passwords. This approach increases security risks and conflicts with Microsoft’s broader move away from password-based authentication. The Exchange team notes that the Microsoft 365 Mailbox Replication Service (MRS) previously did not support OAuth for these migration scenarios.

Security teams have been forced to maintain legacy authentication methods during mailbox migrations, creating an exception to modern identity security practices. This can increase exposure to credential theft, complicate password management, and raise compliance concerns during migration projects.

OAuth works in hybrid and non-hybrid environments

Microsoft has added OAuth authentication support to the Microsoft 365 Mailbox Replication Service, which allows administrators to authenticate mailbox migrations without relying on privileged credentials. After configuring OAuth, organizations can create OAuth-based migration endpoints and use them for migration batches, onboarding, and offboarding moves.

This feature works in both hybrid and non-hybrid Exchange environments. Microsoft says support is currently available for Microsoft 365 multi-tenant environments and on-premises deployments running Exchange Server Subscription Edition (SE) or Exchange Server 2019 CU15 with the latest October 2026 updates.

Keep in mind that OAuth is currently optional, not a mandatory replacement for Basic Authentication. Existing migration endpoints and active migrations continue to function unchanged, which minimizes disruption but also means organizations must decide whether to invest time in configuring the more secure method. Moreover, this feature is currently available to Microsoft 365 multi-tenant environments, with support for other cloud environments expected later.