Microsoft Announces Discontinuation of OWA Light in Exchange Server, Citing Security Reasons
Microsoft is set to deprecate Outlook Web Access (OWA) Light, the lightweight webmail version for on-premises Exchange Server users, with its permanent removal planned for the next major update.
Microsoft has announced plans to discontinue Outlook Web Access (OWA) Light, an older email client designed for browsers that do not support full features. This change will only affect users of on-premises Exchange Server installations. Regarding the announced timeline, Microsoft has already begun the deprecation process for OWA Light as of August 19, 2024, and plans to permanently remove this feature in the next major Exchange Server update, expected around August 2026. After this, users will no longer be able to select or be redirected to the OWA Light interface and will be required to use the standard Outlook on the web version. OWA Light was introduced with Exchange Server 2007 as an alternative for users accessing email via older web browsers that didn't support the full version at the time (e.g., browsers other than Internet Explorer 6 or 7). Its primary function was to provide a basic email experience. However, with most modern web browsers now highly capable and standards-compliant, the necessity for OWA Light has significantly diminished. The main reason Microsoft decided to remove OWA Light is "security and engineering," as stated in the official Exchange team blog. Maintaining OWA Light, which has a separate codebase, adds complexity to development and maintenance. Microsoft points out that OWA Light's existence necessitated redundant evaluations of every part of the program to enhance protection against modern web threats. Discontinuing OWA Light will allow engineering teams to fully dedicate resources to developing and securing the standard Outlook on the web version. For System Administrators in organizations still using Exchange Server, Microsoft recommends immediately disabling OWA Light without waiting until 2026 to mitigate security risks. This can be done using the following PowerShell commands: `Set-OwaMailboxPolicy -OwaLightEnabled $false` to disable it for users, and `Set-OwaVirtualDirectory -LogonPageLightSelectionEnabled $false` to hide the Light login option on the login page.
This news directly impacts IT departments and system administrators in Thai organizations, both public and private, that still use on-premises Exchange Server. They will need to prepare and plan for this transition to ensure users can smoothly and securely switch to the full Outlook on the web version.