There are two architecturally different ways to add multi-factor authentication (MFA) to Outlook Web App (OWA): protect the OWA and Exchange Admin Center (EAC) login directly with a dedicated component, or add MFA at the Active Directory level so it covers OWA along with every other AD-connected service automatically. Protectimus offers both \u2014 the Protectimus OWA component for the first approach, and Protectimus DSPA (Dynamic Strong Password Authentication) for the second. Which one fits depends on whether you want MFA scoped tightly to webmail and admin access, or applied broadly across your AD-connected infrastructure in one step.<\/p>\n\n\n\n
Outlook Web App exists so people can reach corporate mail from a browser, on any device, from anywhere with an internet connection. That convenience is also the underlying security problem: a compromised username and password is, on its own, sufficient to log in. There’s no network perimeter to cross first, no VPN client to authenticate against \u2014 just a login form facing the public internet.<\/p>\n\n\n\n
Credential-based attacks remain the dominant way organizations get breached. The 2025 Verizon Data Breach Investigations Report found stolen or abused credentials among the leading initial access vectors, with the human element \u2014 phishing, social engineering, simple mistakes \u2014 present in roughly six out of ten breaches analyzed. Business Email Compromise, which can involve compromised corporate email accounts, saw more than $2.77 billion transferred as part of BEC scams in 2024, according to FBI IC3 data cited in the report. Microsoft’s 2025 Digital Defense Report adds a more encouraging number to that picture: modern MFA blocks over 99% of identity-based attacks, including cases where the attacker already holds a valid username and password.<\/p>\n\n\n\n
Put together, those numbers explain why OWA specifically \u2014 rather than “the network” in general \u2014 is worth treating as its own MFA project. A password alone is not enough to keep that login form honest, and MFA is the control that has consistently proven effective against exactly the attack pattern OWA is exposed to.<\/p>\n\n\n\n
Microsoft Exchange Server doesn’t ship with built-in multi-factor authentication for on-premises OWA and EAC logins \u2014 unlike Exchange Online, which can rely on Entra ID conditional access. For on-premises or hybrid deployments, MFA has to be added through a dedicated component or an authentication layer in front of the login process.<\/p>\n\n\n\n
We developed two products for Outlook OWA 2FA. The first product is Protectimus OWA<\/a>, developed specifically for Office OWA integration. The second solution is Protectimus DSPA<\/a> which adds 2FA directly to the repository (Active Directory, Lightweight Directory Access Protocol, databases) and thus adds MFA to everything linked to the business AD, LDAP, etc.<\/p>\n\n\n\n Today we will give you an in depth look into both methods. We will describe their work, show you how to implement each solution and list the tokens that support them.<\/p>\n\n\n\n The first approach adds a second authentication factor to the OWA and Exchange Admin Center login screens specifically, without touching how any other AD-connected system authenticates. In Protectimus’s product line, this is handled by the Protectimus OWA component, a Windows installer deployed on the Exchange Client Access role.<\/p>\n\n\n\n After installation, a user reaches the familiar OWA login page, enters their normal Active Directory username and password, and is then prompted for a one-time password from whichever method the organization has enabled \u2014 an authenticator app, a hardware token, SMS, email, a chatbot, or a push notification. The EAC login can be protected the same way, either alongside OWA or on its own.<\/p>\n\n\n\n This method is a good fit when the goal is narrow: get MFA in front of webmail and admin access without immediately changing how Winlogon, RDP, VPN, or anything else tied to Active Directory behaves. It also supports scoping to a single AD group, so a pilot rollout doesn’t have to touch every mailbox at once.<\/p>\n\n\n\n This product for OWA two-factor authentication runs either in cloud, or locally. You get the full set of advanced features \u2014 geo and time filters, IP filters, user-environment analysis. Every Protectimus token works with this plugin, and it supports third-party tokens as well. During setup, two-factor authentication can be scoped to a single Active Directory group instead of enabled for everyone at once.<\/p>\n\n\n\n Here\u2019s a video to illustrate the above steps:<\/p>\n\n\n\nMethod 1: Protect OWA and EAC Directly<\/strong><\/strong><\/h2>\n\n\n\n