If we employ negotiate authentication, exchange will authenticate the client using NTLM authentication type and if unable to verify authenticity, will challenge the client to authenticate using a username and password. This is a combination of Windows integrated authentication and Kerberos authentication. Negotiate authentication: Enabled by default in Exchange 2013. So, when Outlook is trying to connect to Exchange and if the machine is domain joined, there isn’t a need to provide password. If the authentication exchange initially fails to identify the user, the browser will prompt the user for a Windows user account user name and password. The current Windows user information on the client computer is supplied by the browser through a cryptographic exchange involving hashing with the Web server. NTLM authentication: If you select this authentication type, exchange does not prompt users for a user name and password. It is important for you to understand the difference between several authentication types Exchange offers for Outlook Anywhereīasic authentication: If you select this authentication type, Outlook will prompt for username and password while attempting a connection with Exchange. Outlook Anywhere for a user depends on the attribute “MAPIBlockOutlookRpcHttp” which can be found by running the cmdlet: If you wish to disable Outlook anywhere over the internet in Exchange 2013, simply leave the external hostname entry blank !!! This will ensure that only internal users can access Outlook…

You may leave the external hostname blank if you do not want your external clients to connect to Outlook Anywhere from internet.

Before you proceed please ensure that you have configured a certificate to use with Outlook Anywhere.

Outlook exchange 2013