Enable modern authentication for Skype for Business Online

1

As a Cloud Consultant working with products that are part of the Office 365 and the Microsoft Enterprise Mobility +Security Suite (EMS), I often get a lot of questions about multi-factor authentication (MFA), and how to get started.

Most customers today has a strategy about MFA when employees are trying to access corporate company data from outside the company perimeter. But when customers are using cloud services like Office 365, OneDrive and SharePoint that boundary moves from a physical boundary to the user identity. Therefore the requirement for multi-factor authentication is something that most customers wants to implement as part of their cloud strategy.

The key to a successful MFA deployment starts by enabling modern authentication. Modern authentication brings Active Directory Authentication Library (ADAL)-based sign in to your Office 365 applications, and without this enabled, end users will have to use “App Passwords”, witch is a true nightmare for any user and it department.

By default Office 365 tenants (Exchange Online, SharePoint Online and Skype for Business Online) will need to be configured to accept a modern authentication connection. I recommend that you enabled for modern authentication both Exchange Online and Skype for Business, if you want to use MFA.

  • Skype for Business Online – OFF by default.
  • Exchange Online – OFF by default.
  • SharePoint Online – ON by default.

 

Enable modern authentication for Skype for Business Online

To enable modern authentication for Skype for Business Online, complete the following steps:

Step 1: Install Skype for Business Online, Windows PowerShell Module:
https://www.microsoft.com/en-us/download/details.aspx?id=39366

Step 2: Connect to Skype for Business using PowerShell

$sfboSession = New-CsOnlineSession -UserName user@domain.com
Import-PSSession $sfboSession

SNAGHTML564f75

Step 3: Verify the current settings (optional)
The expected result: ClientAdalAuthOverride : Disallowed

Get-CsOAuthConfiguration

SNAGHTML5951b9

Step 4: Enable modern authentication for Skype for Business Online

Set-CsOAuthConfiguration -ClientAdalAuthOverride Allowed

Step 5: Verify that the change was successful by running the following:
The expected result: ClientAdalAuthOverride : Allowed

Get-CsOAuthConfiguration

SNAGHTML5ba7de

Important: Please note, that it might take up to 24 hours before modern authentication starts to work. Usually it’s less than one hour, but please be patient when you start testing. It you don’t get the result you expect, watch a movie, drink a cup of coffee and try again.
Thanks to @AlexFilipin for reminding me, to add this note to the article.

I have also posted a sample script on Microsoft TechNet Gallery, where all the commands used in this example can be found: https://gallery.technet.microsoft.com/Enable-modern-authenticatio-d7180f99

That’s it… Enjoy!

+Ronni Pedersen

About Author

My name is Ronni Pedersen and I'm currently working as a Cloud Solution Architect at EG A/S in Denmark. My primary focus is Enterprise Client Management solutions, based on technologies like AzureAD, Intune, EMS and System Center Configuration Manager. I'm is also a Microsoft Certified Trainer and Microsoft MVP in Enterprise Mobility.

1 Comment

Leave A Reply