Basic Authentication Deprecation in Exchange Online – What’s Next

Codepoet80 I'm sorry to see that these changes took you by surprise. The thing is that moving away from Basic Authentication has been announced since 2018 (!) and frequently after that. Deadlines have been moved out to give large organizations more time to take the appropriate measurements. If my company, with 80.000 associates and thousands of devices and applications was able to hande this, I'm sure you're family can as well.

Even if you, as the family administrator, are not following blogs or other tech news outlets, multiple notifications have been posted in the Message Center in your tenant. By default these are sent through email to users with an admin role. Finally, this is not a change where Microsoft benefits from. This is a change where the customers are better protected against account breaches, which in turn can be used for identity theft and in many other ways can hurt your users/family members.

The_Exchange_Team Greg Taylor - EXCHANGE 
What would be the best method to analyze how many of our users/applications would be impacted by this? Meaning, if by some reasons some users has been not informed and they have not made required changes to them. Then we perhaps could contact to them, and share the advice for them what to do.

Empower  yes, under Portal Azure -> Sign in logs filter by client app and select the entries below "Legacy Authentication Details". You can find a step by step with screens here.

Codepoet80 - You, as the admin of a tenant who admits not knowing this was coming, should be able to answer your own question of 'why can't we let tenant admins control this themselves?'. Sadly, huge numbers of admins don't read the Message Center, and have no idea what's coming. You are not alone, and so we are taking action to protect your users, and your data. I'll also add that many of those same admins have already been breached using basic auth, and they don't know it. I have personally broken the news to too many of them over the past year or so, and some of those are some of the world's largest companies. Basic auth is a huge risk to your data and accounts. Period. Jetze Mellema nailed it.

To answer your other question, it's impractical in a multi-tenant service with millions of tenants to allow admins of every tenant to maintain some kind of IP basic auth 'allow list' against which every connection is evaluated, for tenant/IP specific settings. It would have a detrimental effect on performance, and lest we forget, source IP is not really reliable as a determining factor. VPN/TOR etc etc. 

Get off POP and IMAP, use ActiveSync, native apps that work with OAuth, Outlook mobile, or switch to OWA on those tablets. If the devices need updating, update them. Or go without email. 

this is great intention for the advance label updating cyber security protocol. we are happy with Microsoft the great decision.. thanks for more updated on the time based. i think this upcoming version will be getting the benefits, and comfortable for every users..

Deeply and throughly unhappy with this decision. Tenant owners should be able to decide what authentication is appropriate for their organization. This might be best for M$, but not every organization has the ability to replace all their old equipment just because a mega company says so.

Is there a  report that can be ran to show which accounts, if any, still use this soon to be depreciated feature?

Azure AD Sign-In Report filter by Client App?

Our company has been a victim of hacking.  Albeit, small scale phishing that was not due to MS security, but MS support was with us every step of the way and solved the problem, which had nothing to do with their products.  If MS has to take measures to protect us from ourselves, we are definitely OK with that, IF we are given ample time to prepare (and we are) and IF MS is at the ready to support us and resolve any issues after cutover (and they consistently always are).  We HAVE to do the work AND work together to win this battle against global hacking and cyber crime.

We are using SMTP for some system, fax printer. Can we use SMTP after Jan. 2023?

Codepoet80 - what old equipment do you have that uses Autodiscover? ActiveSync and EWS apps use it to find service endpoints. That's it. And if they app can use OAuth, they can use OAuth for Autodiscover. 

Jo_Bowles - no. 

Chau Nguyen - yes.