Exchange Server Expands Outlook Support for AD FS Modern Authentication

Organizations running Exchange Server entirely on-premises often want stronger, modern authentication methods without adopting Microsoft Entra ID or moving to a hybrid cloud deployment. That limitation has historically left some Outlook clients without support for Exchange Server’s AD FS-based Modern Authentication, which creates inconsistent user experiences and adds complexity for IT teams.

This challenge becomes more significant as organizations try to improve security while supporting a combination of desktop and mobile devices. When authentication capabilities vary across clients, administrators may need to rely on alternative configurations or restrict application choices, which increases management overhead and potentially slows modernization efforts.

Outlook for iOS and Android gain on-premises authentication support

To address this issue, Microsoft has expanded Exchange Server AD FS Modern Authentication support to the Outlook for iOS and Outlook for Android apps. This feature was already available for the Outlook on Windows and Mac desktop apps, as well as the native Mail apps on iOS and macOS. With this update, organizations running supported on-premises Exchange deployments can provide a more consistent authentication experience across Microsoft’s Outlook apps.

Microsoft also updated its deployment documentation to consolidate client requirements and configuration steps. This revised guidance includes clearer information on supported operating systems, Outlook versions, Windows configuration requirements, and Mac-specific settings, which makes it easier for IT administrators to validate and deploy.

However, the expansion comes with an important limitation. AD FS Modern Authentication is intended only for organizations running Exchange entirely on-premises without Microsoft Entra ID or a hybrid Exchange configuration. Companies already operating in a hybrid environment are still expected to use Hybrid Modern Authentication (HMA) with Microsoft Entra ID instead. This announcement primarily benefits select customers that remain committed to fully on-premises Exchange deployments.