Outlook Web App (aka Outlook Web Access, or Outlook on the web) – this is basically “webmail” for Exchange, and is accessed over HTTPS.

Outlook – the desktop application that is part of the Office suite, that connects using Outlook Anywhere (aka RPC-over-HTTP) or MAPI/HTTP (both over HTTPS).

Which services are claimed to be impacted by this? After all, there are many ways to access an Exchange mailbox: When two-factor authentication is enabled for a mailbox user, the 2FA requirement can be bypassed for some services. This happens sometimes with security reports about Exchange-related issues, so to try and clarify I will summarize their conclusion as follows: The report is interesting, if a little difficult to read due to mixed terminology.

For the most of this article I’m just going to refer to Exchange in general, and will only specify Exchange Server (on-premises) or Exchange Online (Office 365) when needed for clarity. This week an information security company published their findings that Exchange Server and Exchange Online (Office 365) do not enforce two-factor authentication (2FA) for Exchange Web Services.

Please read the updated notes at the end of this post.

Outlook mfa