Exchange Server Extended Protection

1. or later; update release August 2022 Published timing is qualified; effectiveness is not confirmed.
2. Retired / removed11 Apr 2023 Now: Removed or unsupported

1. September 2021 5 years agomonth window
   • Exchange server versions that support Extended ProtectionRequirement1 condition
2. August 2022 4 years agomonth windowupdate release · Patch Tuesday 9 Aug 2022
   • Exchange server versions that support Extended ProtectionMilestoneRequirement2 conditions
   • Exchange 2013in Extended Protection can't be enabled on Exchange Server 2016 CU22 or Exchange Server 2019 CU11 or older that hosts a Public Folder hierarchyMilestone
   • Exchange 2016in Extended Protection can't be enabled on Exchange Server 2016 CU22 or Exchange Server 2019 CU11 or older that hosts a Public Folder hierarchyMilestone
   • Exchange 2019in Extended Protection can't be enabled on Exchange Server 2016 CU22 or Exchange Server 2019 CU11 or older that hosts a Public Folder hierarchyMilestone
3. 11 Apr 2023 3 years agoRetired / removed
   • Extended Protection can't be enabled on Exchange Server 2013 servers with Public Folders in a coexistence environmentMilestone

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• Front-End
• Microsoft-Server-ActiveSync
• PublicFolderHierarchyHandlerEnablerOverride
• SchUseStrongCryptoOverride
• SslNegotiateCert
• SystemDefaultTlsVersionsOverride

Requirements, exceptions and scope

• GuidanceScope1 passage

  APPLIES TO: 2016 2019 Subscription Edition…

• OverviewScope1 passage

  Windows Extended Protection enhances the existing authentication in Windows Server and mitigates authentication relay or man-in-the-middle (MitM) attacks. This…

• Virtual Directory or vDirScope1 passage
• Extended Protection settingRequirement1 condition2 passages
• SSL FlagsRequirement1 passage
• Prerequisites for enabling Extended Protection on Exchange ServerRecommendation1 passage
• Outlook Anywhere configuration requirementsRequirement1 passage
• NTLM version requirementsRequirementExceptionRecommendation4 conditions4 passages
• TLS requirementsRequirementExceptionScope1 condition4 passages
  SchUseStrongCryptoSystemDefaultTlsVersions
• Third-party software compatibilityExceptionRecommendation1 condition1 passage
• SSL Offloading scenariosRequirement1 passage
• SSL Bridging scenariosRequirement1 passage
• Extended Protection can't be enabled on Exchange Server 2013 servers with Public Folders in a coexistence environmentRequirement1 condition1 passage
• Extended Protection can't be enabled on Exchange Server 2016 CU22 or Exchange Server 2019 CU11 or older that hosts a Public Folder hierarchyRequirement2 conditions2 passages
• Identifying Exchange servers that are published using Hybrid AgentRequirementExceptionScopeRecommendation2 conditions5 passages
  Front-End
• Enabling Extended ProtectionRequirementExceptionRecommendation3 conditions6 passages
  Microsoft-Server-ActiveSyncSslNegotiateCertFront-End
• Enabling Extended Protection by using Exchange Server 2019 CU14 (or later) installerScopeRecommendation1 condition2 passages
• Scenario 3: Skip enabling of Extended Protection by Exchange Server 2019 CU14 (or later) setupRecommendation1 passage
• Enabling Extended Protection by using the PowerShell scriptExceptionRecommendation1 passage
• Permissions to configure Extended Protection by using the PowerShell scriptRequirement1 passage
• Scenario 1: Enable Extended Protection on all Exchange ServerRequirementException2 conditions3 passages
• Scenario 2: Configure Extended Protection when running a Modern Hybrid configurationRequirement1 condition1 passage
  Front-End
• Set Extended Protection to required or accept for on a virtual directoryRequirement1 condition6 passages
• Set the Required SSL setting for a virtual directoryRequirement1 condition4 passages
• Disabling Extended ProtectionRecommendation2 passages
• Renew Exchange CertificatesRequirement2 conditions1 passage
• Known issues with Extended ProtectionRecommendation1 passage
• Issue: Creating Public Folders by using an Outlook client fails with the following error: 'Cannot create the public folder. You do not have sufficient permissi…Requirement2 conditions2 passages
  PublicFolderHierarchyHandlerEnabler
• Warnings and errors during Extended Protection configuration script executionRequirementScopeRecommendation4 conditions3 passages
• Users can't access their mailbox through one or more clientsRequirementRecommendationTentative2 conditions2 passages
  Front-End
• Public Folders are no longer visible/accessibleRequirement1 condition1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.