Microsoft has announced that Direct Certificate-Based Authentication (CBA) to Exchange Online for Exchange ActiveSync (EAS) clients will be retired at the end of 2026.
Historically, enterprise mobile devices (such as iOS Native Mail or Samsung Email provisioned via SCEP/PKCS certificates) could present an X.509 client certificate directly to the Exchange Online front-end (outlook.office365.com/Microsoft-Server-ActiveSync) using Set-OrganizationConfig -ClientAuthCertificatePopulated. Under that legacy flow, Exchange Online validated the certificate directly against the user object without generating a modern OAuth 2.0 token or evaluating Microsoft Entra Conditional Access policies.
Going forward, all certificate-based mobile authentication must authenticate through Microsoft Entra ID Certificate-Based Authentication (Entra CBA) using Modern Authentication (OAuth 2.0), where Entra ID validates the X.509 certificate chain, checks CRLs, enforces Conditional Access, and issues an access token to the ActiveSync client.
In this runbook—live-tested against our LAB 365 (lab365.in / xzf58.onmicrosoft.com) tenant—we show how to audit your Exchange Online ActiveSync posture, identify legacy EAS devices, and migrate to Microsoft Entra ID CBA.
Architecture: Legacy Direct EAS CBA vs. Modern Microsoft Entra ID CBA
- Client sends X.509 cert directly to
outlook.office365.com - Bypasses Entra ID OAuth & Conditional Access
- Relies on legacy Exchange front-end cert mapping
- Root & Intermediate PKI CAs uploaded to Entra Trust Store
- High-affinity binding (
SubjectKeyIdentifier/PrincipalName) - Enforces Phishing-Resistant MFA & Conditional Access
- Device authenticates at
certauth.login.microsoftonline.com - Receives OAuth 2.0 token for Exchange Online
- Full visibility in Entra Sign-In Logs
Step 1: Audit Exchange Online ActiveSync Settings & Connected Mobile Devices
Before modifying your Intune or MDM email profiles, connect to Exchange Online PowerShell and inspect your organization's ActiveSync settings, mobile device mailbox policies, and active mobile partnerships:
# Connect to Exchange Online using Certificate-Based App-Only Auth
Connect-ExchangeOnline `
-AppId "c841ae33-4093-4385-8a90-6a530761f9b9" `
-CertificateThumbprint "BEAC429DE404B46FF030811C0C9DE00DE701C027" `
-Organization "xzf58.onmicrosoft.com" `
-ShowBanner:$false
# 1. Check ActiveSync Organization Settings
Write-Host "=== ActiveSync Organization Settings ===" -ForegroundColor Cyan
Get-ActiveSyncOrganizationSettings |
Select-Object DefaultAccessLevel, UserMailInsert, AllowDirectPush | Format-List
# 2. Check Mobile Device Mailbox Policies
Write-Host "=== Mobile Device Mailbox Policies ===" -ForegroundColor Cyan
Get-MobileDeviceMailboxPolicy |
Select-Object Name, IsDefault, AllowNonProvisionableDevices, PasswordEnabled, MinPasswordLength | Format-Table -AutoSize
# 3. Audit Mailboxes with ActiveSync Enabled & Enumerate ActiveSync Devices
Write-Host "=== Mailboxes with ActiveSync Enabled ===" -ForegroundColor Cyan
$EasMailboxes = Get-CASMailbox -ResultSize Unlimited | Where-Object { $_.ActiveSyncEnabled -eq $true }
$EasMailboxes | Select-Object DisplayName, PrimarySmtpAddress, ActiveSyncEnabled | Format-Table -AutoSize
$DeviceReport = foreach ($Mbx in $EasMailboxes) {
$Devices = Get-MobileDevice -Mailbox $Mbx.PrimarySmtpAddress -ErrorAction SilentlyContinue |
Where-Object { $_.ClientType -eq "EAS" }
foreach ($Dev in $Devices) {
$Stats = Get-MobileDeviceStatistics -Identity $Dev.Guid.ToString() -ErrorAction SilentlyContinue
[PSCustomObject]@{
UserPrincipalName = $Mbx.PrimarySmtpAddress
DeviceFriendlyName= $Dev.FriendlyName
DeviceOS = $Dev.DeviceOS
ClientType = $Dev.ClientType
ClientVersion = $Dev.ClientVersion
DeviceAccessState = $Dev.DeviceAccessState
LastSuccessSync = $Stats.LastSuccessSync
}
}
}
$DeviceReport | Format-Table -AutoSize
Live Output from Our LAB 365 (xzf58.onmicrosoft.com) Tenant:
=== ActiveSync Organization Settings ===
DefaultAccessLevel : Allow
UserMailInsert :
AllowDirectPush :
=== Mobile Device Mailbox Policies ===
Name IsDefault AllowNonProvisionableDevices PasswordEnabled MinPasswordLength
---- --------- ---------------------------- --------------- -----------------
Default True True False
=== Mailboxes with ActiveSync Enabled ===
DisplayName PrimarySmtpAddress ActiveSyncEnabled
----------- ------------------ -----------------
Discovery Search Mailbox DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}@xzf58.onmicrosoft.com True
Sunil Chauhan [email protected] True
Isaiah Langer [email protected] True
Alex Wilber [email protected] True
Miriam Graham [email protected] True
Step 2: How to Tell If an EAS Device Uses Direct CBA vs. Entra ID CBA
How do you distinguish a device using legacy Direct EAS CBA from one already using Microsoft Entra ID CBA?
| Indicator | Legacy Direct EAS CBA (Retiring End of 2026) | Modern Microsoft Entra ID CBA (Supported) |
|---|---|---|
| MDM / Intune Email Profile Auth Type | Authentication Method set to Certificate without OAuth / Modern Authentication enabled | Modern Authentication (OAuth) enabled; certificate selected at the Entra login prompt (certauth.login.microsoftonline.com) |
| Entra ID Sign-In Logs | Does NOT appear in Entra Interactive/Non-Interactive Sign-In Logs (terminated at Exchange front-end) | Appears in Entra Sign-In Logs with Authentication Method = Certificate and Application = Exchange Online |
| Conditional Access Evaluation | Skipped (cannot enforce compliant device or risk policies) | Enforced (supports Phishing-Resistant MFA Authentication Strength) |
Step 3: Configure Microsoft Entra ID Certificate-Based Authentication (CBA) via Microsoft Graph
To migrate devices to Microsoft Entra ID CBA, you must:
- Upload your Root and Intermediate PKI Certificate Authorities (CAs) to the Entra ID PKI Trust Store.
- Enable the
x509Certificateauthentication method in the Authentication Methods Policy with High-Affinity Username Binding (such asSubjectKeyIdentifierorIssuerAndSerialNumber, orPrincipalNamematched againstuserPrincipalName).
You can configure or audit the x509Certificate policy using the Microsoft Graph REST API / PowerShell SDK (requires Policy.ReadWrite.AuthenticationMethod):
# Enable and configure Microsoft Entra ID Certificate-Based Authentication (x509Certificate)
Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod" -NoWelcome
$X509PolicyPayload = @{
"@odata.type" = "#microsoft.graph.x509CertificateAuthenticationMethodConfiguration"
id = "X509Certificate"
state = "enabled"
includeTargets = @(
@{
targetType = "group"
id = "all_users"
isRegistrationRequired = $false
}
)
certificateUserBindings = @(
@{
x509CertificateField = "PrincipalName"
userProperty = "userPrincipalName"
priority = 1
},
@{
x509CertificateField = "SubjectKeyIdentifier"
userProperty = "certificateUserIds"
priority = 2
}
)
authenticationModeConfiguration = @{
"@odata.type" = "#microsoft.graph.x509CertificateAuthenticationModeConfiguration"
x509CertificateAuthenticationDefaultMode = "x509CertificateMultiFactor"
rules = @()
}
}
Invoke-MgGraphRequest `
-Method PATCH `
-Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/x509Certificate" `
-Body ($X509PolicyPayload | ConvertTo-Json -Depth 6)
Step 4: Update Intune / MDM ActiveSync Profiles for Modern Authentication
Once Entra ID CBA is active in your tenant:
- iOS / iPadOS Native Mail (Intune):
- Open Devices -> iOS/iPadOS -> Configuration profiles and select your Email profile.
- Change OAuth (Modern Authentication) to Yes.
- Select your SCEP or PKCS client certificate profile under Identity certificate. When iOS Native Mail connects via OAuth, the WebView redirects to certauth.login.microsoftonline.com and automatically presents the SCEP/PKCS client certificate to Entra ID.
- Android Enterprise:
- Strongly consider migrating users from legacy Android EAS clients to Outlook for iOS and Android, which natively supports Microsoft Authenticator brokered CBA and Conditional Access.
- Disable Unused Per-Mailbox ActiveSync Access:
- For users who only use Outlook Mobile (which uses Microsoft Sync Technology / HX protocol rather than legacy EAS), disable ActiveSync at the mailbox level to shrink your attack surface:
# Disable legacy ActiveSync on mailboxes that only use Outlook Mobile / MAPI
Set-CASMailbox -Identity "[email protected]" -ActiveSyncEnabled:$false