Modern authentication for Exchange Server without hybrid: AD FS-based OAuth for Outlook

Hybrid Modern Authentication needs Microsoft Entra ID, so it doesn't help organisations that run Exchange purely on-premises. Since Exchange Server 2019 CU13, Exchange can instead trust OAuth tokens from your own AD FS farm: Outlook signs in through AD FS, with MFA if you want it, and never sends a password to Exchange. In this post I'll walk through the setup and how to prove it works.

How it works#

Exchange advertises the authorization endpoint of its default auth server (AD FS). Outlook sends the user there, AD FS issues an access token, and Exchange accepts it only from a trusted auth server and only if the user's authentication policy allows modern auth. Everyone else keeps authenticating as today. Use this only in pure on-premises organisations; in hybrid, Microsoft still recommends Hybrid Modern Authentication.

Prerequisites#

• Exchange: all client-facing servers on Exchange Server SE or 2019 CU13 or later (Exchange 2016 mailbox servers can stay behind them), and Active Directory prepared with CU13 or later media, which adds the BlockModernAuth* policy parameters. Exchange 2016 and 2019 have been out of support since 14 October 2025, so build this on SE.
• AD FS: Windows Server 2019 or later, never on an Exchange server, with Web Application Proxy if clients connect from outside.
• Certificates: an AD FS service communication certificate that all clients trust, a token-signing certificate, and your normal Exchange certificate for mail and autodiscover.
• Reachability: https://adfs.contoso.com/federationmetadata/2007-06/federationmetadata.xml opens from Exchange servers and clients.

Tokens work for MAPI over HTTP, EWS, ActiveSync and the offline address book, not for Outlook Anywhere, POP or IMAP.

Step-by-step configuration#

1. Prepare AD FS#

Install the role (Install-WindowsFeature ADFS-Federation -IncludeManagementTools), configure the farm, then make forms authentication primary. Enabling Keep Me Signed In stretches default single sign-on from 8 to 24 hours.

Set-AdfsGlobalAuthenticationPolicy -PrimaryIntranetAuthenticationProvider FormsAuthentication
Set-AdfsGlobalAuthenticationPolicy -PrimaryExtranetAuthenticationProvider FormsAuthentication
Set-AdfsProperties -EnableKmsi $true

2. Create the Outlook application group#

On the AD FS server, create the group, the extra scopes and a native client for Outlook (d3590ed6-52b3-4102-aeff-aad2292ab01c is the Microsoft Office client ID). Microsoft's article adds a second native client, f8d98a96-0999-43f5-8af3-69971c7bb423, for Apple Mail; grant it the same permissions if you use it.

New-AdfsApplicationGroup -Name "Outlook" -ApplicationGroupIdentifier "Outlook" -Disabled:$false
Add-AdfsScopeDescription -Name "EAS.AccessAsUser.All" -Description "EAS scope"
Add-AdfsScopeDescription -Name "EWS.AccessAsUser.All" -Description "EWS scope"
Add-AdfsScopeDescription -Name "offline_access" -Description "Offline Access"
Add-AdfsNativeClientApplication -Name "Outlook - Native application" -ApplicationGroupIdentifier "Outlook" `
  -Identifier "d3590ed6-52b3-4102-aeff-aad2292ab01c" `
  -RedirectUri @("ms-appx-web://Microsoft.AAD.BrokerPlugin/d3590ed6-52b3-4102-aeff-aad2292ab01c","msauth.com.microsoft.Outlook://auth","urn:ietf:wg:oauth:2.0:oob")

Then create one Web API application per client-facing namespace (with https:// and the trailing slash) and grant Outlook access to each:

$fqdns = @("https://mail.contoso.com/","https://autodiscover.contoso.com/")
$rules = @"
@RuleName = "ActiveDirectoryUserSID" c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"] => issue(claim = c);
@RuleName = "ActiveDirectoryUPN" c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"] => issue(claim = c);
@RuleName = "AppIDACR" => issue(Type = "appidacr", Value = "2");
@RuleName = "SCP" => issue(Type = "scp", Value = "user_impersonation");
@RuleName = "SCPEAS" => issue(Type = "scp", Value = "EAS.AccessAsUser.All");
@RuleName = "SCPEWS" => issue(Type = "scp", Value = "EWS.AccessAsUser.All");
@RuleName = "offlineaccess" => issue(Type = "scp", Value = "offline_access");
"@
foreach ($fqdn in $fqdns) {
  Add-AdfsWebApiApplication -Name "Outlook - Web API ($((New-Guid).ToString('N')))" -ApplicationGroupIdentifier "Outlook" `
    -Identifier $fqdn -IssuanceTransformRules $rules -AccessControlPolicyName "Permit Everyone"
}
$scopes = "winhello_cert","email","profile","vpn_cert","logon_cert","user_impersonation","allatclaims","offline_access","EAS.AccessAsUser.All","EWS.AccessAsUser.All","openid","aza"
Get-AdfsWebApiApplication -ApplicationGroupIdentifier "Outlook" | ForEach-Object {
  Grant-AdfsApplicationPermission -ClientRoleIdentifier "d3590ed6-52b3-4102-aeff-aad2292ab01c" `
    -ServerRoleIdentifier ([string]$_.Identifier) -ScopeNames $scopes
}

To require MFA, use an access control policy that demands it instead of Permit Everyone.

3. Create the authentication policies#

In the Exchange Management Shell, block modern auth by default and allow it per user. The default block protects clients that can only get tokens from Microsoft Entra ID, which would otherwise fail to connect.

New-AuthenticationPolicy "Block Modern Auth" -BlockModernAuthWebServices -BlockModernAuthActiveSync -BlockModernAuthAutodiscover `
  -BlockModernAuthImap -BlockModernAuthMapi -BlockModernAuthOfflineAddressBook -BlockModernAuthPop -BlockModernAuthRpc
Set-OrganizationConfig -DefaultAuthenticationPolicy "Block Modern Auth"
New-AuthenticationPolicy "Allow Modern Auth"

4. Point Exchange at AD FS#

Confirm OAuth is listed on the MAPI, EWS, OAB, Autodiscover and ActiveSync virtual directories of every server (MAPI default: {Ntlm, OAuth, Negotiate}); add it with the matching Set- cmdlet where missing. Then trust AD FS, make it the default authorization endpoint, enable OAuth for clients and assign a pilot user:

Get-MapiVirtualDirectory | Format-List Server, *auth*
New-AuthServer -Type ADFS -Name ContosoADFS -AuthMetadataUrl https://adfs.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml
Set-AuthServer -Identity ContosoADFS -IsDefaultAuthorizationEndpoint $true
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
Set-User -Identity pilot.user@contoso.com -AuthenticationPolicy "Allow Modern Auth"

Front-end servers read policy changes within about 30 minutes, or immediately after an IIS reset. For Outlook for Mac, Microsoft also requires this setting override:

New-SettingOverride -Name "EnableKeepADFSHeadersOnTokenExpiry" -Component "OAuth" -Section "KeepADFSHeadersOnTokenExpiry" `
  -Parameters @("Enabled=true") -Reason "ADFS modern auth for Outlook for Mac"
Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh

5. Configure the clients#

Outlook for Windows needs the AD FS URL as a trusted authority (with and without the trailing slash) and the on-premises modern auth switch, ideally deployed by Group Policy:

# Elevated, once per computer
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\AAD\AuthTrustedDomains" -Force | Out-Null
$key = (Get-Item HKLM:).OpenSubKey("SOFTWARE\Policies\Microsoft\AAD\AuthTrustedDomains", $true)
$key.CreateSubKey("https://adfs.contoso.com/") | Out-Null
$key.CreateSubKey("https://adfs.contoso.com") | Out-Null
# As the user who runs Outlook
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Identity\" -Name "EnableExchangeOnPremModernAuth" -Value 1 -Type DWord

On a Mac, add the AD FS host name (no protocol or slash) by MDM or with defaults write com.microsoft.Outlook ADFSAuthorizedURLs -array adfs.contoso.com. Outlook for iOS and Android just need to be current.

Verify#

• Get-AuthServer | Format-List Name, Type, IsDefaultAuthorizationEndpoint shows Type : ADFS and True.
• Get-OrganizationConfig | Format-List OAuth2ClientProfileEnabled, DefaultAuthenticationPolicy returns True and the block policy; Get-User pilot.user@contoso.com | Format-List AuthenticationPolicy shows the allow policy.
• The pilot user sees the AD FS sign-in page instead of a Windows Security prompt, then the mailbox opens.
• Outlook's Connection Status window (Ctrl + right-click the Outlook tray icon) shows Bearer* in the Authn column. Users on the block policy connect as before.

Tips and gotchas#

• Know which clients won't cope. Microsoft's behaviour table says the new Outlook for Windows tries modern auth and fails here, and Thunderbird and the Windows Mail app don't fall back to basic auth. Keep those users on the block policy.
• Cover every namespace. A missing Web API application for autodiscover.contoso.com, or an identifier without the trailing slash, can break sign-in even when mail.contoso.com works.
• OWA and ECP ignore authentication policies; AD FS for Outlook on the web means configuring claims-based authentication.
• Watch the AD FS certificates with Get-AdfsCertificate: an expired service communication certificate stops clients reaching the sign-in page.

References#

• Enable Modern Auth in Exchange Server on-premises (Microsoft Learn)
• Hybrid Modern Authentication overview and prerequisites (Microsoft Learn)