Hybrid Modern Authentication for Exchange Server: enable HMA and validate Outlook sign-in

Hybrid Modern Authentication (HMA) lets Outlook users whose mailboxes are still on Exchange Server sign in with Microsoft Entra ID tokens instead of NTLM or Basic, so MFA and Conditional Access cover them too. Turning it on takes only a few commands, but one missing URL or virtual directory setting is enough to cause password prompts. In this post I'll go through the prerequisites, the configuration and how to prove that Outlook is really using it.

How it works and prerequisites#

When Outlook connects to an on-premises mailbox, Exchange answers with an authentication challenge that points Outlook to Microsoft Entra ID. Outlook requests an access token for your on-premises URL, such as https://mail.contoso.com. Entra ID recognizes that URL because it is registered as a service principal name (SPN) on the Office 365 Exchange Online service principal (app ID 00000002-0000-0ff1-ce00-000000000000). Exchange then validates the token against the EvoSTS auth server object that the Hybrid Configuration Wizard (HCW) created. Marking EvoSTS as the default authorization endpoint and one organization-wide switch, OAuth2ClientProfileEnabled, turn the behaviour on.

Before you start, check that:

• You run a classic hybrid configured with the HCW. Modern hybrid (the Hybrid Agent) doesn't support HMA.
• Every Exchange server is on the latest update, and none is end-of-life. Exchange 2016 and 2019 reached end of support on 14 October 2025, so in practice that means Exchange Server Subscription Edition (SE). HMA must be configured the same way on all servers; enabling it on only some servers isn't supported.
• All servers can reach the internet (configure the proxy in Exchange if you need one), and nothing in front of them does SSL offloading. SSL bridging is supported.
• All user identities, especially accounts used for administration, are synchronized to Entra ID. Accounts that never sync, such as the built-in Administrator, can't sign in with OAuth once HMA is on.
• The Exchange Server Auth Certificate is valid; Microsoft's MonitorExchangeAuthCertificate script checks it.
• Outlook clients support modern authentication (current Microsoft 365 Apps builds do by default) and connect with MAPI over HTTP. HMA works for MAPI/HTTP, EWS, ActiveSync, the OAB, OWA and ECP, but not for Outlook Anywhere (RPC/HTTP), IMAP or POP.

Step-by-step#

1. Collect every URL Outlook might use#

In the Exchange Management Shell, list the internal and external URLs of each virtual directory:

Get-MapiVirtualDirectory -ADPropertiesOnly | Format-List Server, *url*
Get-WebServicesVirtualDirectory -ADPropertiesOnly | Format-List Server, *url*
Get-OABVirtualDirectory -ADPropertiesOnly | Format-List Server, *url*
Get-AutodiscoverVirtualDirectory -ADPropertiesOnly | Format-List Server, *url*
Get-ActiveSyncVirtualDirectory -ADPropertiesOnly | Format-List Server, *url*
Get-ClientAccessService | Format-List Name, AutodiscoverServiceInternalUri

Write down each distinct host name, internal and external, plus autodiscover.contoso.com.

2. Register the URLs as SPNs with Microsoft Graph PowerShell#

Connect-MgGraph -Scopes Application.Read.All, Application.ReadWrite.All
$sp = Get-MgServicePrincipal -Filter "AppId eq '00000002-0000-0ff1-ce00-000000000000'"
$sp.ServicePrincipalNames | Where-Object { $_ -like 'https://*' }   # what is registered today

$sp.ServicePrincipalNames += "https://mail.contoso.com/"
$sp.ServicePrincipalNames += "https://mail.corp.contoso.com/"
$sp.ServicePrincipalNames += "https://autodiscover.contoso.com/"
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -ServicePrincipalNames $sp.ServicePrincipalNames

Save the "before" list, add only the host names that are missing, then run Get-MgServicePrincipal again to confirm. If your Exchange organization is in hybrid with more than one tenant, register the URLs in every tenant. Use the Microsoft Graph PowerShell SDK; the old MSOnline cmdlets in older guides are retired.

3. Make sure OAuth is enabled on the virtual directories#

Get-MapiVirtualDirectory | Format-List Server, *url*, *auth*
Get-WebServicesVirtualDirectory | Format-List Server, *url*, *oauth*
Get-OABVirtualDirectory | Format-List Server, *url*, *oauth*
Get-AutodiscoverVirtualDirectory | Format-List Server, *oauth*
Get-ActiveSyncVirtualDirectory | Format-List Server, *url*, *auth*

Good looks like OAuth in the authentication methods on every server, for example IISAuthenticationMethods : {Ntlm, OAuth, Negotiate} on MAPI. Fix any gaps with the matching Set- cmdlet, for example Set-WebServicesVirtualDirectory -Identity "EX01\EWS (Default Web Site)" -OAuthAuthentication $true.

4. Confirm the EvoSTS auth server#

Get-AuthServer | Where-Object Name -like "EvoSts*" |
  Format-Table Name, Enabled, IsDefaultAuthorizationEndpoint, DomainName

You should see EvoSts - <GUID> with Enabled True (older HCW versions named it just EvoSTS). If it's missing, run the latest HCW from https://aka.ms/hybridwizard; see my HCW troubleshooting post if the wizard fails.

5. Turn on HMA#

Set-AuthServer -Identity "EvoSts - <GUID>" -DomainName contoso.onmicrosoft.com -IsDefaultAuthorizationEndpoint $true
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

With several tenants, set IsDefaultAuthorizationEndpoint on one EvoSts object only. Clients switch at their next sign-in; there's no need to recreate Outlook profiles, but Exchange can take a while to pick up the change.

Verify#

1. The switch is on: Get-OrganizationConfig | Format-List OAuth2ClientProfileEnabled returns True, and the EvoSts object shows IsDefaultAuthorizationEndpoint True.
2. Exchange advertises Entra ID. From a client, look at the challenge your server returns:
   PowerShell

   curl.exe -s -o NUL -D - -H "Authorization: Bearer" https://mail.contoso.com/ews/exchange.asmx |
     Select-String 'WWW-Authenticate'

   The Bearer challenge should include an authorization_uri that points to Microsoft Entra ID.
3. In Outlook, hold Ctrl, right-click the Outlook icon in the notification area and choose Connection Status. The Authn column for the on-premises mailbox should read Bearer*, not Nego* or NTLM.
4. In the Microsoft Entra admin center, Monitoring & health › Sign-in logs shows the user's Outlook sign-ins to Office 365 Exchange Online, with your Conditional Access policies evaluated.

Tips and gotchas#

• AADSTS500011 ("The resource principal named ... was not found in the tenant") means Outlook asked for a token for a host name that isn't registered as an SPN; repeated password prompts often have the same cause. Compare the URL in the error with your SPN list, including internal and load-balancer names.
• Conditional Access now applies to on-premises mailbox access. Because the switch is organization-wide, review policies that target Exchange Online (MFA, compliant device, blocked platforms) before you enable it.
• Reverse proxies must pass the Authorization header through untouched; pre-authentication in front of Exchange breaks HMA, and SSL offloading isn't supported.
• Outlook for iOS and Android needs the AutoDetect service to reach your servers on TCP 443; Microsoft's HMA article lists the host names and IP ranges.
• OWA and ECP can use HMA too, through a separate procedure in the same article (reply URLs and OAuth on those virtual directories). Treat it as its own change.
• Rollback is a single command: Set-OrganizationConfig -OAuth2ClientProfileEnabled $false turns HMA off for the organization. Keep it in your change plan.
• Don't confuse HMA with Exchange's AD FS-based modern authentication for pure on-premises organizations; in hybrid, Microsoft recommends HMA.

References#

• How to configure Exchange Server on-premises to use Hybrid Modern Authentication (Microsoft Learn)
• Enable Modern Auth in Exchange Server on-premises (AD FS) (Microsoft Learn)