In order for Office desktop clients, such as Outlook, Skype for Business, to support MFA via federated authentication, your Office 365 tenant needs to be configured to support modern authentication.
Enable Exchange Online for modern authentication
Connect to Exchange Online PowerShell as shown below
On your local computer, open Windows PowerShell and run the following command.
$UserCredential = Get-Credential
In the Windows PowerShell Credential Request dialog box, type your work or school account and password, and then click OK.
Run the following command.
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Run the following command.
Import-PSSession $Session
Run the following command in Exchange Online PowerShell:
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
To verify that the change was successful, run the following command in Exchange Online PowerShell:
Get-OrganizationConfig | Format-Table -Auto Name,OAuth*
Enable Skype for Business Online for modern authentication
Connect to Skype for Business Online using remote PowerShell as shown below
- If you have not installed Skype for Business PowerShell Module, click the link to install it on your PC.
Open Windows PowerShell as an administrator (use Run as administrator) on any machine which has Internet connection.
Run the command below, and enter your Office 365 admin account credentials.
$credential = Get-Credential
Run the script below to import the Skype for Business PowerShell Module:
Import-Module SkypeOnlineConnector
Run the command below to create a new session
$session = New-CsOnlineSession -Credential $credential -Verbose
Finally, import the new session into the Windows PowerShell console.
Import-PSSession $session
- Run the following command to enable modern authentication:
Set-CsOAuthConfiguration -ClientAdalAuthOverride Allowed - Verify that the change was successful by running the following:
Get-CsOAuthConfiguration
Note: to disable modern authentication, run command: Set-CsOAuthConfiguration -ClientAdalAuthOverride NoOverride
However, not all Office desktop clients support modern authentication. Generally speaking, Office 2013 and later desktop clients (including Outlook and Skype for Business) support modern authentication. Check the link below for the list of Office clients that support modern authentication: