2FA coming for MS365 email servers Oct 01 2022

[SalesServiceGuy]

Switch to Microsoft Exchange Online 'Modern Auth' before October

On October 1 2022, Microsoft will start switching off Basic Auth for Exchange Online tenants worldwide.

Microsoft Exchange Online to Drop Basic Authentication Support in October


This is the same inconvenience as the Gmail App Password creation for standard scanning dual authentication enabling nightmare.

It's finally time for businesses running Exchange Online to switch from Basic Authentication to Modern Authentication before Microsoft disables the former on October 1, 2022, according to the US Cybersecurity and Infrastructure Security Agency.

One of the key features that Basic Authentication or "Basic Auth" doesn't support is multi-factor authentication (MFA), which is one of the best protections against identity and password attacks.

Microsoft has been urging all organizations to switch to Modern Auth for well over a year. It originally planned to disable Basic Auth in the second half of 2021, but in February 2021 delayed this plan due to the pandemic and eventually set a deadline for October 2022.

"We will start to turn off Basic Authentication in our worldwide multi-tenant service on October 1, 2022. To be clear, we will start on October 1; this is not the date we turn it off for everyone. We will randomly select tenants, send 7-day warning Message Center posts (and post Service Health Dashboard notices), then we will turn off Basic Auth in the tenant. We expect to complete this by the end of this year. You should therefore be ready by October 1," the Exchange Online team said.
"We're turning off Basic Auth for the following protocols: MAPI, RPC, Offline Address Book (OAB), Exchange Web Services (EWS), POP, IMAP, Exchange ActiveSync (EAS), and Remote PowerShell.

"We are not turning off SMTP AUTH. We have turned off SMTP AUTH for millions of tenants not using it, but if SMTP AUTH is enabled in your tenant, it's because we see usage and so we won't touch it. We do recommend you disable it at the tenant level and re-enable it only for those user accounts that still need it.

[rthonpm]

Re: 2FA coming for MS365 email servers Oct 01 2022

All accounts will need for scan to email is SMTP Auth enabled on the account.

Sent from my Pixel 6 Pro using Tapatalk

[SalesServiceGuy]

Re: 2FA coming for MS365 email servers Oct 01 2022

All accounts will need for scan to email is SMTP Auth enabled on the account.

Sent from my Pixel 6 Pro using Tapatalk

... so if a current client is using smtp.office365.com the service provider does not have to do anything?

Toshiba just offered a firmware upgrade as a countermeasure but I can see nothing different in how the smtp client is presented in the web browser.

Is this security change really more about using MS Exchange for sending and receiving every day emails and not so much about using a copier for scan to email?

[rthonpm]

Re: 2FA coming for MS365 email servers Oct 01 2022

... so if a current client is using smtp.office365.com the service provider does not have to do anything?

Toshiba just offered a firmware upgrade as a countermeasure but I can see nothing different in how the smtp client is presented in the web browser.

Is this security change really more about using MS Exchange for sending and receiving every day emails and not so much about using a copier for scan to email?

As long as after the changeover the account used for scanning has SMTP AUTH permissions then there shouldn't be much of a change. That change will need to be made by the Exchange admin, not a technician.

Enable or disable SMTP AUTH in Exchange Online | Microsoft Learn

[jmaister]

Re: 2FA coming for MS365 email servers Oct 01 2022

Getting hit by this...

I am not a IT policy kinda person, w
Whats the Quickest fix?

can I do 2fa for O365 like I do for Gmail?

Edit: but since I don't likely have access to their o365, push back to customer is the most likely scenario?

[SalesServiceGuy]

Re: 2FA coming for MS365 email servers Oct 01 2022

Getting hit by this...

I am not a IT policy kinda person, w
Whats the Quickest fix?

can I do 2fa for O365 like I do for Gmail?

Edit: but since I don't likely have access to their o365, push back to customer is the most likely scenario?

... unless your copier provider has recently made new firmware available to counter this new security requirement from Microsoft there is likely no easy fix.

This only sems to effect the rare customer who has POP3 enabled on their copiers using MS365.

[slimslob]

Re: 2FA coming for MS365 email servers Oct 01 2022

Getting hit by this...

I am not a IT policy kinda person, w
Whats the Quickest fix?

can I do 2fa for O365 like I do for Gmail?

Edit: but since I don't likely have access to their o365, push back to customer is the most likely scenario?

Provide the link rthonpm posted to the customer's IT provider. It is already in their ballpark, your are just providing them with proper information from Microsoft If they do not have an IT administers their email accounts should know the credentials need to access their MS365 Administration Center.

[rthonpm]

Re: 2FA coming for MS365 email servers Oct 01 2022

... unless your copier provider has recently made new firmware available to counter this new security requirement from Microsoft there is likely no easy fix.

This only sems to effect the rare customer who has POP3 enabled on their copiers using MS365.

This isn't a firmware issue: it's an account permission issue.

POP, IMAP, and SMTP access aren't required for 99% of all M365 accounts, so there's no need for them to be enabled.

Sent from my Pixel 6 Pro using Tapatalk

[slimslob]

Re: 2FA coming for MS365 email servers Oct 01 2022

This isn't a firmware issue: it's an account permission issue.

POP, IMAP, and SMTP access aren't required for 99% of all M365 accounts, so there's no need for them to be enabled.

Sent from my Pixel 6 Pro using Tapatalk

I never had a customer want to receive email on their copier. Therefore I never enabled POP on any machine.

[SalesServiceGuy]

Re: 2FA coming for MS365 email servers Oct 01 2022

This isn't a firmware issue: it's an account permission issue.

POP, IMAP, and SMTP access aren't required for 99% of all M365 accounts, so there's no need for them to be enabled.

Sent from my Pixel 6 Pro using Tapatalk

... and yet Toshiba recently released V1800 firmware to accommodate this new requirement by introducing a new drop down box in the POP3 web browser menu.

[rthonpm]

Re: 2FA coming for MS365 email servers Oct 01 2022

I've had a client that had the POP feature for email to print.

They had a system that couldn't be connected to a printer that generated a PDF report by email. The copier in their QA department would get the report, and print it for the team to review in the morning and keep in a binder for inspectors to review.



Sent from my Pixel 6 Pro using Tapatalk

[rthonpm]

Re: 2FA coming for MS365 email servers Oct 01 2022

... and yet Toshiba recently released V1800 firmware to accommodate this new requirement by introducing a new drop down box in the POP3 web browser menu.

Even for POP, the permission to access the mailbox using it still has to be enabled by an Exchange admin, which MFP firmware can't change.

What does the drop down give as options?


For 99.98% of clients the only necessary feature for mail is going to be SMTP, which will continue to work as long as SMTP Auth is enabled.

Sent from my Pixel 6 Pro using Tapatalk

[diedux]

Re: 2FA coming for MS365 email servers Oct 01 2022

I recently had to configure a workflow for a document management system that takes an email attachment from mailbox 0365 and then processes it in some way. It would have been a 10-minute job anyway, but IMAP basic auth connections are no longer supported. Fortunately, the system supported OAuth, so (two hours later...) I configured it.
Lucky for us, Microsoft doesn't have target for SMTP auth depreciation. YET..!

[rthonpm]

Re: 2FA coming for MS365 email servers Oct 01 2022

Lucky for us, Microsoft doesn't have target for SMTP auth depreciation. YET..!

SMTP Auth will likely be around for awhile longer. Even Microsoft's own email reporting features built into Windows Server don't offer modern authentication, as well as many other enterprise applications, even in versions from this year.

There will likely be other security requirements for accounts that have the feature enabled or even guidance and best practices.

We have customers create a dedicated account with just a basic Office subscription that gets used for SMTP. To differentiate the device that the email comes from, we just create group emails that the account has rights to send from so that scans from an MFP come from one address and emails from an application come from another, but the underlying credentials are the same. For AD environments, the account is associated with a domain account that is disabled, that way there's no way to use the account for anything other than sending emails.

From history as well, even if Microsoft deprecates a feature it will still be around for quite awhile. The LPD service was deprecated with Server 2016, yet it's still available in Server 2022, so the feature will still be around until at least 2032.

Sent from my Pixel 6 Pro using Tapatalk

[SalesServiceGuy]

Re: 2FA coming for MS365 email servers Oct 01 2022

SMTP Auth will likely be around for awhile longer. Even Microsoft's own email reporting features built into Windows Server don't offer modern authentication, as well as many other enterprise applications, even in versions from this year.

There will likely be other security requirements for accounts that have the feature enabled or even guidance and best practices.

We have customers create a dedicated account with just a basic Office subscription that gets used for SMTP. To differentiate the device that the email comes from, we just create group emails that the account has rights to send from so that scans from an MFP come from one address and emails from an application come from another, but the underlying credentials are the same. For AD environments, the account is associated with a domain account that is disabled, that way there's no way to use the account for anything other than sending emails.

From history as well, even if Microsoft deprecates a feature it will still be around for quite awhile. The LPD service was deprecated with Server 2016, yet it's still available in Server 2022, so the feature will still be around until at least 2032.

Sent from my Pixel 6 Pro using Tapatalk

... on Toshiba's current generation of copiers, a popular optional app adds scan to OneDrive for Busines, SharePoint and Exchange at a low cost. I know other OEMs offer a similar app package.

User Authentication must be enabled such as a PIN code or Card Swipe and the MS365 Administrator has to grant some permissions before the app will perform as advertised.

The Exchange app actually sends a scan to email using the users email address and not the copier's generic email address. The scan appears in the users outbox in Outlook just like they sent it from within their own computer.

While many IT Mangers are trusting of scanning documents to directly to folders within OneDrive or SharePoint, they are not keen to enable the Exchange feature. Probably because these scans are usually PDFs, DOCX or JPEGs and never exe files.

IT Managers would prefer that users perform the extra step of first scanning documents from the copier to themselves and then forwarding the same document to their target destinations.

Since email is the #1 method hackers use to attack any business a cautious approach is understandable.