exchange web services modern authentication

Older versions of the Office thick clients use basic authentication with Office 365. We don’t (yet) use MFA with Office 365 so the settings I discussed in the prior article don’t apply to it. This is in contrast with the older and well established SAML and WS-Trust authentication protocols which are SOAP-based. OIDC, as it is abbreviated, uses a web-API friendly exchange to authenticate users. This is nothing but a lame pseudonym for OpenID Connect.

Many of the Office 2016 apps (and some of the Office 2013 apps with the right updates and registry settings) can use what Microsoft likes to call Modern Authentication. However, you can’t use a browser-based HTTP debugger/tracer with a thick client like Outlook. In my prior post I explain how SAML Tracer can be helpful. Things got very complicated when we started getting errors from users of Outlook hitting our Office 365 Exchange Online. 1 It turns out that was just the beginning of this long, tortured journey.

My first baby steps in this process were documented in a prior post.

We’ve recently thrown the load balancer switch to send users to our new ADFS 4.0 farm rather than the old ADFS 2.x farm.

Exchange web services modern authentication