MC1169566 – M365 Change Digest

One-line summary

Exchange ActiveSync CBA traffic will be routed to new, dedicated endpoints to support TLS 1.3; update SEG/firewall configs if filtering ActiveSync traffic.

Similar updates

Details

Summary

Exchange ActiveSync Certificate-Based Authentication now supports TLS 1.3, routing traffic to new tenant-location-based endpoints. Most clients will redirect seamlessly, but organizations using Secure Email Gateways may need to update firewall settings. Rollout began globally, expanding to other clouds by November 2025.

Body (from Message Center)

As part of our ongoing security efforts, we have made a recent change to Certificate-Based Authentication (CBA) behavior for Exchange ActiveSync. The enhancement is designed to support TLS 1.3, strengthening security and reliability for our customers.

With this change all Exchange ActiveSync CBA traffic will be routed to new, dedicated endpoints based on tenant location

[How this will affect your organization:]

This change has already begun to roll out in the worldwide multi-tenant cloud and will start rolling out in other clouds starting November 2025. As a result of this change all Exchange ActiveSync CBA traffic will be routed to new, dedicated endpoints based on tenant location:

Multi-tenant (Worldwide and GCC): outlook-cba.office365.com
DoD: outlook-dod-cba.office365.us
GCC-High: outlook-cba.office365.us

[What you need to do to prepare:]

For most Exchange ActiveSync clients, this change will be seamless. The client traffic will be implicitly redirected to the new CBA endpoints without any user action required.

However, if your organization uses a Secure Email Gateway (SEG) or similar gateway that filters or inspects ActiveSync traffic, you may need to update your firewall or gateway configuration to allow traffic to and from the new CBA endpoints listed above.

If you have questions or concerns on this change, please contact your SEG vendor. We appreciate your cooperation and commitment to maintaining a secure environment.

Learn more:

Upcoming TLS Changes for Certificate Based Auth ActiveSync Traffic.

RFC 8446 - The Transport Layer Security (TLS) Protocol Version 1.3

Specified at [MS-ASHTTP]: Authorization | Microsoft Learn ActiveSync official documentation, EAS requests without authorization header will be treated as a CBA request.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": null,
    "ai_actions": [
      "Update SEG/firewall to allow new CBA endpoints if filtering ActiveSync traffic"
    ],
    "ai_master_tags": [
      "Security",
      "Network"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Exchange ActiveSync CBA traffic will be routed to new, dedicated endpoints to support TLS 1.3; update SEG/firewall configs if filtering ActiveSync traffic.",
    "ai_topics": [
      "Exchange"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "Exchange ActiveSync Certificate-Based Authentication now supports TLS 1.3, routing traffic to new tenant-location-based endpoints. Most clients will redirect seamlessly, but organizations using Secure Email Gateways may need to update firewall settings. Rollout began globally, expanding to other clouds by November 2025."
    },
    "id": "MC1169566",
    "importance": 1,
    "is_major_change": false,
    "last_modified": "2025-10-10T15:51:29Z",
    "ms_products": [
      "Exchange"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Exchange Online"
    ],
    "severity": "normal",
    "tags": [
      "Feature update",
      "Admin impact"
    ],
    "title": "Exchange ActiveSync TLS 1.3 Certificate Based Authentication Change"
  }
}