The report claims that Exchange Web Services (EWS) is the vulnerable protocol. In addition to those mailbox access methods, an Office 365 user can access other services such as SharePoint Online, OneDrive for Business, the Office 365 portal, Yammer, Planner, etc.

Autodiscover – this is a means of discovering configuration options and service endpoints for a mailbox, and is accessed over HTTPS.

The REST APIs are expected to replace EWS in future.

REST APIs – another programmatic method of accessing mailboxes, again over HTTPS.

POP and IMAP use the standard ports for those services.

POP/IMAP – legacy protocols that are disabled by default for Exchange Server, but enabled by default for Exchange Online.

Exchange Web Services (EWS) – this is generally used for programmatic access to mailbox content, such as Outlook accessing calendar free/busy information, but can also be used as the primary access protocol by clients such as Outlook for Mac, the deprecated OWA for Devices mobile app, various Office 365 migration tools and mailbox backup products, etc.

ActiveSync – this is for mobile access, such as from iPhone/Android native mail apps, and mobile apps like the mobile version of Outlook, and is accessed over HTTPS.

Exchange Control Panel (ECP) – this is effectively the “options” section of OWA, and is accessed over HTTPS.

Outlook Web App (aka Outlook Web Access, or Outlook on the web) – this is basically “webmail” for Exchange, and is accessed over HTTPS.

Outlook – the desktop application that is part of the Office suite, that connects using Outlook Anywhere (aka RPC-over-HTTP) or MAPI/HTTP (both over HTTPS).

Which services are claimed to be impacted by this? After all, there are many ways to access an Exchange mailbox: When two-factor authentication is enabled for a mailbox user, the 2FA requirement can be bypassed for some services. This happens sometimes with security reports about Exchange-related issues, so to try and clarify I will summarize their conclusion as follows:

The report is interesting, if a little difficult to read due to mixed terminology. For the most of this article I’m just going to refer to Exchange in general, and will only specify Exchange Server (on-premises) or Exchange Online (Office 365) when needed for clarity. This week an information security company published their findings that Exchange Server and Exchange Online (Office 365) do not enforce two-factor authentication (2FA) for Exchange Web Services. Please read the updated notes at the end of this post.

Outlook for mac 2 factor not working