OWA multi-factor authentication

What is OWA and why does it need MFA?

Outlook Web Access (OWA) is the browser-based counterpart to the on-premises email and task management application, Microsoft Outlook. With the solution providing enterprise users access to their OWA email, calendars, tasks, and contacts from Microsoft Exchange directly from their web browsers, securing logins to OWA is vital. The existing username and password-based authentication process is not considered secure enough by many IT security experts. Unauthorized access to a user's OWA interface risks the exposure of sensitive business information and confidential email correspondence between users. An effective solution is to supplement the logins with further authentication levels through OWA two-factor authentication (2FA) or multi-factor authentication (MFA).

Secure enterprise email access ADSelfService Plus' OWA multi-factor authentication

ManageEngine ADSelfService Plus enables OWA MFA and Exchange MFA by implementing additional authentication steps in addition to the default username and password during OWA and Exchange Admin Centre logins. This means that even if a user's credentials are misused, the enforced MFA process prevents the user account from being compromised. Unlike other solutions, ADSelfService Plus does not provide just 2FA for OWA, but also includes options to enable a maximum of three additional authentication factors. OWA MFA is achieved through various authentication methods including the phishing-resistant and passwordless FIDO2 authentication, and biometric authentication.

How does OWA two-factor authentication work?

To configure OWA MFA and MFA for EAC logins, the ADSelfService Plus' OWA connector must be installed in the Exchange server. The connecter acts as the intermediary between the Exchange server and ADSelfService Plus to enable MFA during OWA and EAC logins. Once these requirements are fulfilled, the process shown below takes place:

1. The user attempts to login to OWA or the EAC.
2. The user is asked to complete the primary authentication in OWA application.
3. If this is successful, the OWA application passes a request to the ADSelfService Plus connector which informs ADSelfService Plus to proceed with the authentication factors.
4. If the user completes all the required authentication factors successfully, they are logged in to OWA or the EAC.

MFA for OWA and EAC logins can be configured for the following Exchange versions:

• Exchange Server 2019
• Exchange Server 2016
• Exchange Server 2013
• Exchange Server 2012

For the detailed configuration steps, refer to the MFA for OWA login help document.

Supported authentication methods

ADSelfService Plus supports a wide range of authenticators. Those that can be configured for OWA MFA are listed here.

• Biometric authentication (fingerprint/facial recognition)
• Duo Security
• Smart card authentication
• Microsoft Authenticator
• Google Authenticator
• YubiKey authentication
• Email verification

Why choose ADSelfService Plus for OWA multi-factor authentication?

Employing ADSelfService Plus' OWA MFA and Exchange MFA delivers the following benefits:

• Conditional access: Automatically heighten or relax 2FA for OWA flows based on risk factors such as IP address, geolocation, time-based access, and device type.
• Real-time audit reports: View detailed reports on OWA MFA and EAC MFA with information like time of logon, authentication methods used, and authentication success or failure status.
• Holistic endpoint MFA: Configure MFA for Windows, OWA and EAC logins, local and remote machine access across platforms—including Windows MFA, macOS, and Linux—and implement strong protection for all VPN logins.
• Achieve regulatory compliance: Comply with regulatory mandates such as the NIST and PCI-DSS which recommend enabling MFA for accessing email accounts.