On-premises Exchange Server combines an internet-facing web stack, deep Active Directory rights and, in hybrid estates, a trust path into Exchange Online, which is why it keeps appearing in the CISA Known Exploited Vulnerabilities catalog. ProxyLogon, ProxyShell and ProxyNotShell were all pre-authentication or low-privilege chains against OWA, ECP, EWS and Autodiscover, and the 2025 hybrid flaw CVE-2025-53786 showed that an attacker with admin rights on one on-premises server could reach the cloud tenant. This guide covers how authentication and RBAC work in Exchange, which roles and service principals are effectively Tier 0, how to configure Extended Protection, AMSI and the Emergency Mitigation service, what to log, and the patch discipline Exchange demands. It is for Exchange and Windows administrators, identity teams and SOC engineers still running Exchange 2019 or Exchange Server Subscription Edition (SE).
Key takeaways
- Stay on a supported build or disconnect. Exchange 2016 and 2019 reached end of support in October 2025, and security fixes target only the latest and previous cumulative update; anything older should be treated as exposed.
- Exchange is Tier 0 in practice. Organization Management, the Exchange Trusted Subsystem and Exchange Windows Permissions groups hold rights over Active Directory; protect them like Domain Admins or move to split permissions.
- Turn on Extended Protection everywhere. It binds NTLM and Kerberos authentication to the TLS channel and blocks the relay attacks that several Exchange CVEs depend on, but it requires consistent TLS and no SSL offloading.
- Hybrid is a cloud identity. The hybrid connection is an Entra application with a certificate credential; move to the dedicated hybrid app and clear certificates from the shared first-party service principal.
- Assume you will need to hunt. Keep IIS, HttpProxy, admin audit and AMSI filtering logs long enough to answer "was this server exploited before we patched".
How identity and access work in Exchange Server
Exchange authenticates users against Active Directory and authorises administration through role based access control (RBAC). Client protocols are published by IIS virtual directories on the Mailbox server, which in current versions also hosts the client access front end.
| Endpoint | Used by | Default authentication | Exposure note |
|---|---|---|---|
| /owa, /ecp | Outlook on the web, Exchange admin center | Forms based (NTLM or Kerberos behind it), optionally AD FS claims or Hybrid Modern Auth | Publish /ecp internally only where possible; it was the target of several post-auth RCE chains |
| /ews | Outlook for Mac, integrations, hybrid free/busy | NTLM, Kerberos, OAuth | Common integration surface; ApplicationImpersonation grants access to any mailbox through it |
| /mapi, /rpc | Outlook for Windows | NTLM, Kerberos, OAuth with Hybrid Modern Auth | Core client traffic |
| /Microsoft-Server-ActiveSync | Mobile mail | Basic over TLS, OAuth with Hybrid Modern Auth | Password spray target when Basic is used |
| /autodiscover | Client configuration | Varies | Abused for SSRF in ProxyShell and ProxyNotShell |
| /powershell | Exchange Management Shell remoting | Kerberos | Should never be reachable from the internet |
- Hybrid Modern Auth: moves Outlook and mobile clients to Entra ID tokens so MFA and Conditional Access apply on-premises. It is the most effective way to remove password-only protocols from the internet edge.
- NTLM: still widely used internally, which is why relay protection matters. See the NTLM Relay Guide for the relay mechanics this guide does not repeat.
Admin roles and privileged access
RBAC has three building blocks: management roles (sets of cmdlets and parameters), role groups (universal security groups that carry administrative roles) and role assignment policies (end-user roles beginning with "My" applied to mailboxes). Scopes restrict where a role assignment applies.
| Role group or role | What it can do | Treat as |
|---|---|---|
| Organization Management | Almost any task on any Exchange object; can grant itself further roles | Tier 0; a handful of named admin accounts, no mailboxes on those accounts |
| Exchange Trusted Subsystem (system group) | Read and write to every Exchange object, local Administrators on Exchange servers, member of Exchange Windows Permissions | Tier 0; any Exchange server compromise inherits it |
| Exchange Windows Permissions (system group) | In shared and RBAC split models, rights on many non-Exchange AD objects and attributes | Tier 0; reduce with AD split permissions |
| Server Management | Server level transport, mailbox and client access configuration | Tier 1 with change control |
| Recipient Management | Create and modify recipients | Tier 1; scope to OUs with management scopes |
| Discovery Management | Search any mailbox, place holds | High sensitivity; legal and compliance only, every search audited |
| ApplicationImpersonation role | Act as any mailbox in scope through EWS | A non-human privilege; assign only with a management scope to a specific service account |
| Hygiene Management | Anti-spam and anti-malware configuration; third-party tools often add their service accounts | Review membership for stale vendor accounts |
Shared, RBAC split or AD split permissions
- Shared (default): Exchange administrators can create AD security principals through Exchange tools. Simplest, weakest separation.
- RBAC split: only a role group you create (plus Exchange servers and services) can create principals. Microsoft recommends this for most organisations because it keeps most of the separation with far less friction.
- AD split: removes Exchange's ability to create security principals and removes the Exchange Windows Permissions rights on non-Exchange AD objects; enabled with
Setup.exe /PrepareAD /ActiveDirectorySplitPermissions:True. Mailboxes and groups must then be created in AD first. Choose it where the AD team must own every principal and Exchange compromise must not equal AD compromise; expect more operational overhead. - Practical controls: use dedicated admin accounts from privileged access workstations, review
Get-ManagementRoleAssignmentoutput monthly, never change the Exchange Trusted Subsystem membership or ACLs manually (Microsoft warns this can cause irreparable damage), and include Exchange in your AD tiering. See the Active Directory and Entra ID Hardening Guide.
Integrations, API tokens and service accounts
Exchange estates accumulate non-human identities: hybrid applications, archive and backup service accounts, multifunction printers relaying mail, CRM connectors and monitoring tools. Each one is a credential with mailbox or transport rights.
- Dedicated hybrid application: historically, the Hybrid Configuration Wizard uploaded the on-premises Auth Certificate to a shared first-party Exchange Online service principal. CVE-2025-53786 abused that trust: with admin access to an on-premises server, an attacker could escalate into Exchange Online. CISA Emergency Directive 25-02 required agencies to apply the April 2025 Hotfix Update, deploy the dedicated Exchange hybrid app with
ConfigureExchangeHybridApplication.ps1 -FullyConfigureExchangeHybridApplicationand then purge the shared principal's key credentials. Microsoft's documentation names the parameter-ResetFirstPartyServicePrincipalKeyCredentialsand warns that re-running the Hybrid Configuration Wizard with the OAuth option re-uploads the certificate, so the reset must be repeated. - Timeline to plan against: Microsoft permanently blocked EWS access through the shared service principal on 31 October 2025, made a Graph based hybrid flow available from the May 2026 Hotfix Update, and lists October 2026 for the retirement of EWS in Exchange Online. Check the current documentation before relying on these dates.
- Auth Certificate: it signs OAuth tokens between on-premises Exchange and the cloud. Monitor its expiry with Microsoft's MonitorExchangeAuthCertificate script, keep its private key on Exchange servers only, and include it in your certificate inventory.
- Service accounts with impersonation: grant ApplicationImpersonation through a management scope limited to the mailboxes the application needs, give the account no interactive logon, and alert on its use from unexpected hosts. See the Service Account Security Guide.
- SMTP relay: anonymous relay receive connectors should be bound to specific source IPs. Devices that authenticate to SMTP hold passwords that rarely rotate; inventory them.
- Last Exchange Server: after moving mailboxes to Exchange Online, many organisations keep one server for recipient management. CISA highly recommends decommissioning it once it is no longer needed; Microsoft offers management tools without a full server for that purpose.
Logging and detection
| Source | Location or command | What to look for |
|---|---|---|
| IIS logs | %SystemDrive%\inetpub\logs\LogFiles | Unusual POSTs to /owa/auth, /ecp, /autodiscover with SSRF patterns; requests to unexpected .aspx files (web shells, ATT&CK T1505.003) |
| HttpProxy logs | V15\Logging\HttpProxy | Requests routed to unexpected back ends or with anomalous authenticated user values |
| AMSI request filtering | %ExchangeInstallPath%\Logging\HttpRequestFiltering | Entries with ScanResult Detected; any file here means a blocked request |
| Admin audit log | Search-AdminAuditLog | New role assignments, New-ManagementRoleAssignment, mailbox export requests, transport rule changes, mitigation settings disabled |
| Mailbox audit | Mailbox audit logging | Non-owner access, delegate additions (T1098.002), mass item access |
| Emergency Mitigation service | Application log source MSExchange Mitigation Service | Event 1005 and 1006 (mitigation applied), 1008 (cannot reach the Office Config Service) |
| Windows security log | Domain controllers and Exchange servers | Group changes to Organization Management and Exchange Windows Permissions; new local admins |
| Entra ID | Sign-in and audit logs | Credentials added to the hybrid application or the Exchange first-party service principal |
Map detections to ATT&CK T1190 Exploit Public-Facing Application, T1505.003 Web Shell, T1114.002 Remote Email Collection and T1098.002 Additional Email Delegate Permissions. The Silk Typhoon Threat Actor Profile Guide covers the group Microsoft associated with the 2021 ProxyLogon exploitation.
Metrics
- Patch latency: days from an Exchange Security Update or Hotfix Update to installation on every server; target days, not weeks, for internet-facing servers.
- Health Checker findings: count of red findings across the estate from Microsoft's Exchange Server Health Checker script, trending to zero.
- Extended Protection coverage: percentage of servers and virtual directories with Extended Protection enabled.
- Privileged membership: number of members in Organization Management and Discovery Management, and number of ApplicationImpersonation assignments without a scope (target zero).
- Legacy authentication: share of client connections still using Basic or NTLM from the internet.
Hardening baseline
| Area | Setting | Reference |
|---|---|---|
| Version | Exchange SE or Exchange 2019 CU15 with the latest update; nothing older than the previous CU | Exchange updates page |
| Extended Protection | Enabled on all servers (default from 2019 CU14) via ExchangeExtendedProtectionManagement.ps1 | Microsoft Learn Extended Protection article |
| TLS consistency | SchUseStrongCrypto and SystemDefaultTlsVersions set to 1 on every server | Extended Protection prerequisites |
| NTLM | LmCompatibilityLevel 5 (minimum 3) under HKLM\System\CurrentControlSet\Control\Lsa | Extended Protection prerequisites |
| Load balancer | No SSL offloading; SSL bridging only with the same certificate as Exchange | Extended Protection prerequisites |
| AMSI | Compatible AMSI provider; body scanning on (default from the August 2025 Security Update, setting override section AmsiRequestBodyScanning) | Microsoft Learn AMSI article |
| Emergency Mitigation | MitigationsEnabled true at organisation and server level; outbound 443 to officeclient.microsoft.com excluded from TLS inspection | Microsoft Learn EEMS article |
| Publishing | Only required virtual directories reachable from the internet; /ecp and /powershell internal only | Reverse proxy or firewall rules |
| Client auth | Hybrid Modern Auth with MFA; disable Basic on ActiveSync and EWS where possible | Entra Conditional Access |
| Permissions model | RBAC split or AD split; scoped role assignments | Split permissions article |
| Hybrid | Dedicated hybrid app; first-party service principal key credentials purged | CISA ED 25-02, dedicated hybrid app article |
Rolling out Extended Protection and updates
- Inventory: run the Exchange Server Health Checker on every server to capture CU, SU, TLS settings and Extended Protection state; disconnect servers that cannot be brought to a supported build, as ED 25-02 required.
- Fix prerequisites: align TLS registry values, set
LmCompatibilityLevel, remove SSL offloading, and test third-party proxies or antivirus that inspect TLS locally. - Pilot: enable Extended Protection on one server with the script; test Outlook, OWA, ECP, ActiveSync, Mac clients, hybrid free/busy and mailbox moves. For servers published through the Hybrid Agent, exclude the front-end EWS virtual directory with
-ExcludeVirtualDirectories "EWSFrontEnd". - Roll out to remaining servers and re-run the Health Checker.
- Rollback:
ExchangeExtendedProtectionManagement.ps1 -DisableExtendedProtection -ExchangeServerNames <server>, noting Microsoft's warning that disabling it re-exposes known vulnerabilities; fix the blocking dependency rather than leaving it off. - Update cadence: install each Security Update or Hotfix Update in a test server first, then production within your critical patch SLA. See the Patch Management Guide.
Common misconfigurations
- Unsupported or lagging builds: the KEV catalog lists ProxyLogon (CVE-2021-26855, CVE-2021-27065), ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), ProxyNotShell (CVE-2022-41040, CVE-2022-41082) and CVE-2024-21410, all with known ransomware use except the last. Servers more than one CU behind no longer receive fixes.
- Patched but not investigated: applying an update does not remove web shells or accounts added before patching. After any Exchange KEV, hunt IIS logs and the OWA and ECP directories for new .aspx files.
- Extended Protection blocked by SSL offloading: load balancers that terminate TLS prevent channel binding, so teams leave protection off. Re-architect to SSL bridging with the same certificate.
- Hybrid certificate left on the shared principal: deploying the dedicated app but skipping the key credential reset, or re-running the wizard afterwards, leaves the CVE-2025-53786 path open.
- Unscoped impersonation: an archive or migration tool granted ApplicationImpersonation organisation-wide can read every mailbox, and its password often sits in a configuration file.
- Exchange outside AD tiering: admins log on to Exchange servers from ordinary workstations, or Exchange servers share local admin passwords, so one compromised server becomes domain compromise through Exchange's AD rights.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ATT&CK |
|---|---|---|---|
| Supported builds and timely updates | SI-2, CM-8 | ID.RA-01, PR.PS-02 | T1190 |
| RBAC, split permissions, scoped roles | AC-5, AC-6 | PR.AA-05 | T1098.002, T1078.002 |
| Extended Protection, TLS | SC-8, IA-2 | PR.AA-03 | T1557.001 |
| Service account and hybrid app credentials | IA-5, AC-2 | PR.AA-01 | T1078.002 |
| Web shell and abuse detection | SI-4, AU-12 | DE.CM-09 | T1505.003, T1114.002 |
Practitioner checklist
- Run the Exchange Server Health Checker on every server and disconnect any server that cannot reach a supported build.
- Enable Extended Protection on all servers, fixing TLS consistency, NTLMv2 and SSL offloading first.
- Confirm AMSI body scanning and the Emergency Mitigation service are active, with their logs collected.
- Reduce Organization Management to named admin accounts and move to RBAC split or AD split permissions.
- Scope every ApplicationImpersonation assignment and inventory all Exchange service accounts and relay devices.
- In hybrid estates, deploy the dedicated hybrid app, reset the first-party service principal key credentials and monitor Entra for new credentials on either.
- Publish only required virtual directories externally and move clients to Hybrid Modern Auth with MFA.
- Keep IIS, HttpProxy and admin audit logs for at least 90 days and run a compromise hunt after every Exchange KEV.
Standards and references
- Microsoft Learn: Permissions in Exchange Server
- Microsoft Learn: Split permissions in Exchange Server
- Microsoft Learn: Configure Windows Extended Protection in Exchange Server
- Microsoft Learn: Deploy dedicated Exchange hybrid app
- CISA: Emergency Directive 25-02 Mitigate Microsoft Exchange Vulnerability
- Microsoft Learn: AMSI integration with Exchange Server
- Microsoft Learn: Exchange Emergency Mitigation Service
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: NTLM Relay Guide · Active Directory and Entra ID Hardening Guide · Patch Management Guide · Service Account Security Guide · Silk Typhoon Threat Actor Profile Guide