Exchange Online: What is difference between Basic Authentication and Modern Authentication without MFA

Question

What is difference between the basic authentication which being ended and modern auth without MFA https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps#connect-to-exchange-online-powershell-without-using-mfa.

Answer 1

While the Powershell examples like the one above look quite similar to the original basic authentication examples, Exchange Online's "modern authentication" uses a completely different mechanism under the hood. Where the old mechanism is an exchange of credentials using Windows-based Active Directory protocols, the new mechanism uses the OAuth Authorisation Code Grant mechanism. This is the same as the mechanism you use when signing into a third party website with your Google or Facebook credentials. It allows a website or application to trust you based on a third party's authentication of you (known as federation of authentication), without ever knowing your logon details, and is designed to work securely over the web.

Why are Microsoft making this change?

There are several reasons why Microsoft is likely making this change:

• It's cross-platform and a common web-standard authentication mechanism
  • They can use the same mechanism throughout their products
  • Only need to support one mechanism. Brings Powershell, C# etc in line with how the Web UI works
  • Will work with Windows, Mac, Linux
  • Many people are already familiar with it
• Microsoft has implemented the OAuth standards as a layer on top of Active Directory. Moving to OAuth should allow Exchange Online and other products to use other authentication servers which implement OAuth, freeing them up to be sold into the non-Windows world which Microsoft is heading into.

OAuth Authorisation Code Grant

The flow looks like this. Much of this is necessary 1) because the application involved is delegating the authentication and 2) to keep details as secure as possble when passing over the web. You can see that Powershell is hiding much of the complexity. Image Credit: C# Corner