The Azure AD authentication endpoint will detect the UPN domain is federated and do another redirection to the internal AD FS endpoint on-premises (in my case “ fs.azurelab.dk”), where AD FS will require the client to authenticate. More specifically, when the web client connects to “ ” either by redirection from the on-premises Exchange OotW URL in a hybrid deployment scenario or by selecting the Outlook app title in the Office Portal, Exchange Online redirects the web client to the authentication endpoint in Azure Active Directory ( ).įigure 1: Web Client redirected from to on-premises AD FS farm A passive profile client that is domain-joined and located on internal network authenticates directly with the AD FS (STS) endpoint on-premises. For now, we will focus on non-modern authentication, so the only Exchange Online client using this endpoint is Outlook on the Web (OotW). This endpoint is used by web clients or by all clients that use the new modern authentication method. Passive Federation (WS-Fed Passive Profiles) We have the following endpoints for Exchange client authentication: When it comes to the different clients accessing the Exchange Online workload in an “Federated Identities” model, they use different endpoints for authentication. We have the Outlook Desktop client, Outlook on the Web (OotW), the Outlook app for iOS and Android, ActiveSync based clients, IMAP/POP clients, SMTP clients and clients based on the Exchange Web Services (EWS) protocol such as Outlook for Mac. As you know, we can access our mailbox using several different clients. However, when it comes to the “Federated Identities” model, depending on the client as well as the version of a client used to access the Exchange Online workload, the above does not necessarily match the reality.
#Exchange online client password
Cloud Identities, Synchronized Identities with Password Hash enabled and Federated Identities. So as we discussed in the previous two parts of this article series, you can choose between three different identity models.
Exchange Online Client Authentication – The Past & Today In this part 3, we will continue where we left off in part 2.
#Exchange online client series
In part 2 of this article series revolving around the available identity models and the authentication story for Exchange Online, I provided you with an insight into the third identity model, which is federated identities.
Exchange Online Identity Models and Authentication Demystified (Part 6).Exchange Online Identity Models and Authentication Demystified (Part 5).Exchange Online Identity Models and Authentication Demystified (Part 4).Exchange Online Identity Models and Authentication Demystified (Part 2).Exchange Online Identity Models and Authentication Demystified (Part 1).If you would like to read the other parts in this article series please go to:
0 kommentar(er)
