This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 74%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDM%3C/text%3E%3C/svg%3E)
I’m working on an on-prem Exchange 2019 farm that is multi-tenant. I am being asked to find a way to block OWA for just some of the tenants. The tenants are separated by OU, GAL and domain space and etc…. I have browsed to the file system path C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy and set permissions on the OWA directory by adding a test user and setting the explicit Deny on all severs. That user can still log into OWA. Any other ideas?
Thanks!!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 22%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKY%3C/text%3E%3C/svg%3E)
If you would like to disable OWA access for users in specified OUs, I suppose you may use the following command in Exchange Management Shell:
Get-mailbox -OrganizationalUnit "Contoso.com/Tailspintoys" | Set-CASMailbox -OWAEnabled:$false
It would disable OWA for all users in the Tailspintoys OU.
When users enter their credentials to log in OWA, they would see the following error:
You may also do it in Exchange Admin Center.
Here is a link on this topic for your reference: Enable or disable Outlook on the web access to mailboxes in Exchange Server
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Thank you for the info. My apologies but I left out a detail. I have a second OWA site for the second set of users so I can completely disable OWA feature. Just OWA for the default OWA site for a group of users. I want a group of users to have to use 2FA and a group users to not have to use 2FA. Any other ideas would be greatly appreciated.
Thanks!!
Hi,
Have you followed suggestions in this article: Configuring Multiple OWA/ECP Virtual Directories on the Exchange 2013 Client Access Server Role
It introduces how to setup multiple virtual directories for OWA and ECP.
If you have done it already, I suppose you may setup 2FA on the additional sites to have the specific group users to use 2FA to authenticate OWA.
For example, if you would like to use ADFS, here is also a link about how to setup ADFS for OWA:
Use AD FS claims-based authentication with Outlook on the web
Just checking in to see if above information was helpful.
Please let us know if you would like further assistance.