Exchange server 2013 proxy authentication

Question

Hi All,
I wanted to know what is the recommended proxy authentication for exchange server 2013. 
I have observed the following from different proxy authentications:
1. Negotiate: By default, the proxy authentication is set to negotiate and uses anonymous as Log on network security(un-encrypted MAPI)
2. Basic: It always prompts for the user credentials and uses encrypted MAPI.
3. NTLM: Use negotiate at MAPI level by default
Please provide me some information on different authentication mechanisms and the one which is recommended to use. 
Thanks,
Srinivas.

Answer 1

Hi Srinivas,
According to my knowledge, there are my views below:
Basic authentication: If you select this authentication type, Outlook will prompt for username and password
while attempting a connection with Exchange.
NTLM authentication: If you select this authentication type, exchange does not prompt users for a user
name and password. The current Windows user information on the client computer is supplied by the browser through a cryptographic exchange involving hashing with the Web server. If the authentication exchange initially fails to identify the user, the browser
will prompt the user for a Windows user account user name and password. So, when Outlook is trying to connect to Exchange and if the machine is domain joined, there isn’t a need to provide password.
Negotiate authentication: Enabled by default in Exchange 2013. This is a combination of Windows integrated
authentication and Kerberos authentication. If we employ negotiate authentication, exchange will authenticate the client using NTLM authentication type and if unable to verify authenticity, will challenge the client to authenticate using a username and password.
And you could set the authentication type like this:
ExternalClientAuthenticationMethod : Basic
InternalClientAuthenticationMethod : Ntlm
IISAuthenticationMethods           : {Basic, Ntlm, Negotiate}
The command below for your reference:
Get-OutlookAnywhere | Set-OutlookAnywhere -InternalHostname "internalServer.contoso.com" -InternalClientAuthenticationMethod Ntlm -InternalClientsRequireSsl $true -ExternalHostname "externalServer.company.com" -ExternalClientAuthenticationMethod Basic -ExternalClientsRequireSsl $true -IISAuthenticationMethods Negotiate,NTLM,Basic
If you have any further questions, please let me know.
Best regards,
Eric