Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Key Takeaways
- Outlook for iOS and Android now support Exchange Server AD FS Modern Authentication, joining the Windows, Mac, and native mobile Mail apps that already had it.
- This is aimed squarely at organizations running Exchange fully on-premises — no Microsoft Entra ID, no hybrid configuration.
- Hybrid Exchange customers should keep using Hybrid Modern Authentication (HMA) with Microsoft Entra ID; this update doesn’t change anything for them.
What’s Going On
If you’ve kept Exchange entirely on-premises, you’ve likely run into an awkward gap: Outlook for Windows and Mac, plus the native Mail apps on iOS and macOS, could already use AD FS-based Modern Authentication against your on-prem Exchange deployment — but Outlook for iOS and Android couldn’t. That inconsistency meant either restricting which apps staff could use, or falling back to weaker authentication just to keep mobile Outlook working.
Microsoft has now closed that gap. Outlook for iOS and Android join the list of clients that support Exchange Server AD FS Modern Authentication, giving fully on-premises shops a consistent sign-in experience across desktop and mobile without needing to adopt Entra ID or move to a hybrid model.
Who Actually Benefits
This isn’t for everyone. It specifically targets organizations that run Exchange entirely on-premises with no Microsoft Entra ID and no hybrid Exchange configuration. If you’re already hybrid, nothing changes for you — Microsoft is explicit that hybrid customers should keep using Hybrid Modern Authentication (HMA) with Entra ID rather than switching to AD FS.
| Client | AD FS Modern Auth Support |
|---|---|
| Outlook for Windows / Mac | Already supported |
| Native Mail app (iOS / macOS) | Already supported |
| Outlook for iOS | New in this update |
| Outlook for Android | New in this update |
AD FS Modern Authentication is intended only for organizations running Exchange entirely on-premises without Microsoft Entra ID or a hybrid Exchange configuration.
What IT Admins Should Do Now
Microsoft also consolidated its deployment documentation alongside this release, so this is a good moment to revisit your AD FS Modern Auth setup even if you’re not changing anything else.
Practical Steps
- Confirm you’re actually fully on-prem. Before touching anything, verify your organization has no Entra ID or hybrid Exchange dependency — AD FS Modern Auth isn’t the right path if you do.
- Review the updated deployment guide. Microsoft consolidated client requirements and configuration steps into a single revised doc, covering supported OS versions, Outlook versions, and Windows/Mac-specific settings — worth a re-read even if you deployed AD FS Modern Auth previously.
- Pilot on mobile before a broad rollout. Test Outlook for iOS and Android against a small group first, since this is genuinely new client support rather than a mature, long-tested path.
- Communicate the mobile app requirement. Users may currently rely on the native Mail app or a workaround client on mobile; plan the switch to Outlook mobile deliberately rather than leaving it to word of mouth.
- Don’t touch hybrid tenants. If any part of your org is hybrid, leave HMA with Entra ID in place — this update doesn’t apply to that path.
Bottom Line
This is a narrow but genuinely useful fix for the shrinking-but-still-real population of fully on-premises Exchange shops: Outlook mobile finally catches up to desktop and native Mail app support for AD FS Modern Authentication. If that’s your environment, it’s worth planning a rollout; if you’re hybrid, this news simply isn’t for you.
vmorecloud.com · Windows Server, Azure, VMware & Home Lab Insights
