AutoDiscover Archives - Practical 365

Microsoft Turns Off Basic Authentication for Autodiscover

Tony Redmond — Fri, 18 Nov 2022 11:00:00 +0000

Now that they've disabled basic authentication for email connection protocols, Microsoft is doing the same for the Autodiscover service. This makes sense. There's no point in allowing basic authentication for Autodiscover when clients can't use basic authentication to connect. Microsoft will therefore turn off basic authentication for Autodiscover as it removes basic authentication for protocols like POP3, EAS, IMAP4, EWS, and MAPI.

The post Microsoft Turns Off Basic Authentication for Autodiscover appeared first on Practical 365.

Make Sure Your Implementation of Autodiscover Avoids Common Pitfalls

James Yip — Wed, 14 Sep 2022 10:00:00 +0000

This article explains the importance of deploying Autodiscover correctly to ensure that all of Microsoft 365 works, including Exchange Online.

The post Make Sure Your Implementation of Autodiscover Avoids Common Pitfalls appeared first on Practical 365.

Researcher Says Autodiscover Problem is Client-Side, Not in Exchange

Tony Redmond — Tue, 12 Oct 2021 18:30:31 +0000

An interesting and worthwhile interview (available on YouTube) with security researcher Amit Serper reveals a lot more detail about the Autodiscover credential leak reported by Guardicore last month. The interview (with three Office 365 MVPs) goes through the collection of leaked credentials, how Serper tried to reproduce the problem, and his interaction with Microsoft. It’s a real pity Serper didn’t include the information in his original report as it would have taken a lot of heat out of the situation.

The post Researcher Says Autodiscover Problem is Client-Side, Not in Exchange appeared first on Practical 365.

Why a Potential Autodiscover Flaw is Just the Tip of an Iceberg

Steve Goodman — Tue, 28 Sep 2021 05:55:00 +0000

It's often helpful when security researchers like Guardicore shed light on flaws in Microsoft Exchange - however, the Autodiscover protocol isn't flawed in the way they describe. Even though the issue is hard to replicate, it shouldn't distract from the work you need to do to protect your organization from the underlying reason why people want your credentials.

The post Why a Potential Autodiscover Flaw is Just the Tip of an Iceberg appeared first on Practical 365.

Hot Air and Publicity for Purported Autodiscover Security Flaw

Tony Redmond — Thu, 23 Sep 2021 14:04:13 +0000

Lots of excitement was generated when Guardicore revealed a purported vulnerability with the Exchange Autodiscover service. However, the almost total lack of detail about the configuration used for testing and to generate the reported results makes it impossible for Exchange administrators to check the theory against their own deployment. I don't think a problem exists with Exchange Online, but it's possible that poor DNS practice or flawed third-party clients could cause an issue with on-premises servers. The case remains to be proved.

The post Hot Air and Publicity for Purported Autodiscover Security Flaw appeared first on Practical 365.

Fixing Autodiscover Root Domain Lookup Issues for Mobile Devices

Paul Cunningham — Thu, 17 Nov 2016 04:02:43 +0000

How to fix Exchange Server Autodiscover failures for ActiveSync mobile devices due to HTTPS issues with root domain lookups.

The post Fixing Autodiscover Root Domain Lookup Issues for Mobile Devices appeared first on Practical 365.

Outlook Certificate Security Alert after Exchange Server 2013 Installation

Paul Cunningham — Thu, 29 May 2014 12:52:48 +0000

Outlook clients may begin displaying a security alert warning dialog after an Exchange 2013 server installed into an existing organization.

The post Outlook Certificate Security Alert after Exchange Server 2013 Installation appeared first on Practical 365.

Exchange Server 2010 to 2013 Migration – Reviewing Autodiscover Configuration

Paul Cunningham — Thu, 29 May 2014 12:41:19 +0000

Some considerations for Autodiscover when planning an Exchange 2013 deployment in an existing Exchange 2010 organization.

The post Exchange Server 2010 to 2013 Migration – Reviewing Autodiscover Configuration appeared first on Practical 365.

Exchange Server 2013: Using Test-OutlookWebServices to Verify Web Services Functionality

Paul Cunningham — Wed, 07 Aug 2013 12:50:53 +0000

Using the Test-OutlookWebServices PowerShell cmdlet to test web services in Exchange Server 2013.

The post Exchange Server 2013: Using Test-OutlookWebServices to Verify Web Services Functionality appeared first on Practical 365.

Exchange 2010 FAQ: Common Concerns When Installing the First Exchange 2010 Server

Paul Cunningham — Sun, 15 Jul 2012 02:50:24 +0000

A run down of some of the common concerns people have when installing the first Exchange 2010 server into their production environment.

The post Exchange 2010 FAQ: Common Concerns When Installing the First Exchange 2010 Server appeared first on Practical 365.