MC203731 – (Updated) Feature Update: Restricting form-based authentication in Office apps (archived)

Product:

Azure Active Directory, Forms, Microsoft 365 Apps, Office Client

Platform:

Windows Desktop, World tenant, Online

Status:

Change type:

Links:

Details:

Updated May 5, 2020: To ensure the best possible experience for our users, we are delaying some of our deployments to reduce the amount of change flowing into the services. The new deployment timeline is outlined below.
To help provide additional security coverage, we are changing how form-based authentication in Office applications is handled. Forms-based authentication is a legacy authentication method for Office resources that are not protected by Azure Active Directory (AAD) or Microsoft account (MSA).

We'll be rolling this out to the Office ProPlus Monthly Insiders channel starting in mid-February and other channels should expect the change to be deployed by the end of May (previously February).

Because Office does not know the location of the form-based authentication, Office will block such sign-in dialogs and will notify the end-user that the sign-in has been blocked.
End users can unblock themselves by changing a security setting in Trust Center.
They can do so proactively by going to File > Options > Trust Center > Trust Center Settings > Form-based sign-in, or
They can wait until they have been prompted to open Trust Center via a warning dialog.
In the Trust Center > Form-based Sign-in panel, end-users should:
Change “Block all sign-in prompts” to “Ask me what to do for each host”
Select “Save” in the lower right corner of the window.
The list of safe hosts will be auto-populated based on future end-user actions.
After a user makes this change in Trust Center, Office will not block future sign-in prompts. Instead, it will show a dialog similar to this:
If an end-user clicks Yes at this step, two things happen:
Office will show the sign-in prompt immediately.
In the future, Office will provide sign-in prompts for this allowed host, which will be added to the list of “Hosts allowed to show sign-in prompts” in Trust Center > Form-based Sign-in.

Change Category:
XXXXXXX ...

Scope:
XXXXXXX ...

Release Phase:

Created:
2020-02-13

updated:
2020-05-06