authenticationPolicies

Authentication Policies. Block legacy basic authentication on a per-protocol basis. The authenticationPolicies entity set lives under /exchange/v1.0/authenticationPolicies in the Roles & access category.

Fact	Value
Path	`/exchange/v1.0/authenticationPolicies`
Category	Roles & access
Tier	Tier 9, Hybrid and organization
Read role	`OrganizationConfig.Read.All` (Community)
Write role	`OrganizationConfig.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-AuthenticationPolicy, Set-AuthenticationPolicy, New-AuthenticationPolicy, Remove-AuthenticationPolicy

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/authenticationPolicies`	List authentication policies - per-protocol legacy-auth allow/block toggles for IMAP, POP, MAPI, OAuth, etc.	`OrganizationConfig.Read`	Community
POST	`/exchange/v1.0/authenticationPolicies`	POST /authenticationPolicies - create a policy. Name optional per Wiki (positional [[-Name]]); each Allow/Block protocol toggle is a switch.	`OrganizationConfig.ReadWrite`	Enterprise
GET	`/exchange/v1.0/authenticationPolicies/{key}`	Get a single authentication policy by Identity. Returns 404 if absent.	`OrganizationConfig.Read`	Community
PATCH	`/exchange/v1.0/authenticationPolicies/{key}`	PATCH /authenticationPolicies/{key} - flip protocol switches on or apply allowLegacyExchangeTokens / blockLegacyExchangeTokens / tenantId. Returns 200 + the post-Set policy.	`OrganizationConfig.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/authenticationPolicies/{key}`	DELETE /authenticationPolicies/{key} - remove a policy. Returns 204.	`OrganizationConfig.ReadWrite`	Enterprise

GET /exchange/v1.0/authenticationPolicies

List authentication policies - per-protocol legacy-auth allow/block toggles for IMAP, POP, MAPI, OAuth, etc.

Backing cmdlet: Get-AuthenticationPolicy. Role: OrganizationConfig.Read (Community).

Parameter	In	Type	Required	Description
`allowLegacyExchangeTokens`	query	bool (switch)

List authentication policies

Returns all authentication policies in the tenant. Each policy carries per-protocol allow/block toggles for legacy auth (IMAP, POP, MAPI, OAuth, and others) that you assign to users via PATCH /users/{key}.

GET /exchange/v1.0/authenticationPolicies HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#authenticationPolicies",
  "value": []
}

POST /exchange/v1.0/authenticationPolicies

POST /authenticationPolicies - create a policy. Name optional per Wiki (positional [[-Name]]); each Allow/Block protocol toggle is a switch.**

Backing cmdlet: New-AuthenticationPolicy. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type
`allowBasicAuthActiveSync`	body	boolean (switch)
`allowBasicAuthAutodiscover`	body	boolean (switch)
`allowBasicAuthImap`	body	boolean (switch)
`allowBasicAuthMapi`	body	boolean (switch)
`allowBasicAuthOfflineAddressBook`	body	boolean (switch)
`allowBasicAuthOutlookService`	body	boolean (switch)
`allowBasicAuthPop`	body	boolean (switch)
`allowBasicAuthPowershell`	body	boolean (switch)
`allowBasicAuthReportingWebServices`	body	boolean (switch)
`allowBasicAuthRpc`	body	boolean (switch)
`allowBasicAuthSmtp`	body	boolean (switch)
`allowBasicAuthWebServices`	body	boolean (switch)
`name`	body
`dryRun`	query	bool (switch)

Create a block-legacy-auth policy

Provision an authentication policy via New-AuthenticationPolicy. The canonical pattern is the inverse of what Wiki suggests: each AllowBasicAuth* SwitchParameter, when ABSENT, leaves the protocol blocked (the cmdlet’s default state); when PRESENT (true) it explicitly allows Basic auth for that protocol. So ‘block all legacy auth’ means ‘don’t send any AllowBasicAuth* switches’. Block 4 live-verify on the dev tenant 2026-05-28 confirmed that the BlockLegacy*/BlockModern* switches documented in Wiki SYNTAX are NOT supported on the cloud EXO runspace; the API drops them from the writable set and the Reference UI does not surface them. To re-enable a protocol on an existing policy, PATCH with allowBasic<Protocol>: true.

POST /exchange/v1.0/authenticationPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "Block-All-Legacy-Protocols"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/authenticationPolicies/Block-All-Legacy-Protocols

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#authenticationPolicies/$entity",
  "Id": "authpolicy-block-all-legacy",
  "Name": "Block-All-Legacy-Protocols",
  "Identity": "authpolicy-block-all-legacy",
  "AllowBasicAuthActiveSync": false,
  "AllowBasicAuthAutodiscover": false,
  "AllowBasicAuthImap": false,
  "AllowBasicAuthMapi": false,
  "AllowBasicAuthOfflineAddressBook": false,
  "AllowBasicAuthOutlookService": false,
  "AllowBasicAuthPop": false,
  "AllowBasicAuthPowerShell": false,
  "AllowBasicAuthReportingWebServices": false,
  "AllowBasicAuthRpc": false,
  "AllowBasicAuthSmtp": false,
  "AllowBasicAuthWebServices": false
}

GET /exchange/v1.0/authenticationPolicies/{key}

Get a single authentication policy by Identity. Returns 404 if absent.

Backing cmdlet: Get-AuthenticationPolicy. Role: OrganizationConfig.Read (Community).

PATCH /exchange/v1.0/authenticationPolicies/{key}

PATCH /authenticationPolicies/{key} - flip protocol switches on or apply allowLegacyExchangeTokens / blockLegacyExchangeTokens / tenantId. Returns 200 + the post-Set policy.

Backing cmdlet: Set-AuthenticationPolicy. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type
`allowBasicAuthActiveSync`	body	boolean (switch)
`allowBasicAuthAutodiscover`	body	boolean (switch)
`allowBasicAuthImap`	body	boolean (switch)
`allowBasicAuthMapi`	body	boolean (switch)
`allowBasicAuthOfflineAddressBook`	body	boolean (switch)
`allowBasicAuthOutlookService`	body	boolean (switch)
`allowBasicAuthPop`	body	boolean (switch)
`allowBasicAuthPowershell`	body	boolean (switch)
`allowBasicAuthReportingWebServices`	body	boolean (switch)
`allowBasicAuthRpc`	body	boolean (switch)
`allowBasicAuthSmtp`	body	boolean (switch)
`allowBasicAuthWebServices`	body	boolean (switch)
`allowLegacyExchangeTokens`	body	boolean (switch)
`blockLegacyExchangeTokens`	body	boolean (switch)
`tenantId`	body
`dryRun`	query	bool (switch)

Update an authentication policy

Flip protocol toggles or apply legacy-Exchange-token settings on an authentication policy. Backed by Set-AuthenticationPolicy; returns 200 with the post-Set policy.

PATCH /exchange/v1.0/authenticationPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "allowBasicAuthImap": true,
  "blockLegacyExchangeTokens": true,
  "tenantId": "contoso.com"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-authenticationPolicies",
  "Identity": "exonaut-sample-authenticationPolicies",
  "Name": "exonaut-sample-authenticationPolicies",
  "AllowBasicAuthImap": true,
  "BlockLegacyExchangeTokens": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative. Allow*/Block* fields are PowerShell SwitchParameters - send true to enable; a switch cannot be flipped back off via PATCH.

DELETE /exchange/v1.0/authenticationPolicies/{key}

DELETE /authenticationPolicies/{key} - remove a policy. Returns 204.

Backing cmdlet: Remove-AuthenticationPolicy. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete an authentication policy

Remove an authentication policy by Identity. Backed by Remove-AuthenticationPolicy; returns 204 No Content.

DELETE /exchange/v1.0/authenticationPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.