(Updated) Reminder: Basic Authentication deprecation in Office Apps

MC499030 – Updated April 6, 2023: Microsoft has updated the timing for this change below. Thank you for your patience.

This is a reminder that Microsoft 365 Apps are disabling server sign-in prompts using Basic authentication in Office Apps (originally communicated in MC454810, November ’22). Microsoft is making this change because basic authentication is a legacy authentication method that sends a username and password with each request. As a result, an attacker can access these credentials and use them to access resources. Continued use of Basic Authentication is a big security concern, so it has decided to deprecate it from all tenants.

Microsoft will retire this feature in Office Apps version 2301+. Instead, Microsoft recommends moving to a more secure authentication method, preferably Modern Authentication, and enabling multi-factor authentication based on OAuth2.0 token-based auth.

This retirement will not affect Exchange Online and Exchange on-premises. Customers using basic authentication to connect to Exchange on-premises/Exchange Online can continue to use basic authentication without any changes to Exchange.

There is a separate effort to retire Outlook connecting to Exchange Online using Basic Authentication. Please see Exchange Online – September 2022 Update.

Windows files share access is not affected. The underlying authentication layer for file share is NTLM, and there is not change to NTLM. More information is here – Microsoft SMB Protocol Authentication – Win32 apps | Microsoft Learn.

Access to files stored on SharePoint on-premises server that are using basic authentication will be blocked. However, files stored on SharePoint Online, OneDrive for Business are not affected. Customers who currently store files on web servers that use Basic authentication can move those files to SharePoint Online, OneDrive for Business, SharePoint Server on-premises or a more secure authentication protocol as a solution.

When this will happen:

Microsoft will be rolling this change beginning late March and will complete by mid-April.

How this will affect your organization:

You are receiving this message because your organization may be using basic authentication to access resources.

Once Basic authentication is disabled in your tenant, users with the Office Version 2301 or higher on their devices will not be able to access resources from servers using Basic authentication.

After the upgrade, end-users will get a warning message first, and encourage users to move away from basic authentication. Warning message will appear till April 2023.

User warning prompt
View image in new tab

Microsoft will move to blocking stage in May 2023. From May 2023, if a user tries to open a file stored on a server still using Basic Authentication, Office Client App will block the sign-in prompt and present this pop-up message to the user.

User blocked prompt
View image in new tab

Note: Exchange Online team is working on deprecating Basic Authentication separately, Outlook will continue to support Basic Authentication with Exchange Online till that work is complete. Access to all other resources using Basic Authentication will be blocked in Outlook Version 2301 and higher. Deprecation of Basic authentication in Exchange Online

This is a sample Basic Authentication login window:

User login prompt
View image in new tab

What you need to do to prepare:

You should move the servers using Basic authentication to another authentication method.

Please click Additional Information to learn more.

Additional information