Aw nevermind, I figured it out, simply comment out the include Sogo template line in '00-default-ssl.conf' (not certain if that is the best way to do it, but it works.   )

Well this is turning out to be more difficult than I would have expected. You're correct, commenting out the Sogo template reference breaks MS Exchange connections for clients. The Sogo "ModulesConstraints" parameter is effective in that it will delete Mail and Calendar access from the Sogo web interface, but it does not completely disable the web interface as the 'Address Book' function is still available (along with ability to change password, etc.) and oddly enough there appears to be no way to delete the Address Book web functionality. The only reference I could find indicates as such and while it is from 2012 and refers to Sogo 2 it still seems accurate in that the Address Book page apparently still cannot be deleted by ModulesConstraints. (https://lists.inverse.ca/sogo/arc/users … 00090.html)

There seems to be many configurable options for the web interface at https://sogo.nu/files/docs/SOGoInstallationGuide.html but as far as I can tell no way to simply disable it entirely. This means that the Sogo web page still remains as an unnecessary security exposure with no way to disable it..? That makes 2FA for Roundcube kinda useless if someone can just go to the Sogo web page and login with a compromised password.

Surely there must be an answer to such a simple thing as disabling the web interface but I am unable to find it (at least in a way that does not also break Exchange functionality for clients.)

Well not a peep from the Sogo support list, but I did figure out a way to disable access to the Sogo web interface without interfering with external ActiveSync client functionality. In the Sogo templates file (/etc/nginx/templates/sogo.tmpl) you can disable http traffic to Sogo by entering:

location ~ ^/SOGo { return 404; }

Enter this immediately after the existing line in the file:  location ^~ /SOGo {   and then restart Nginx.

This will kill traffic to the Sogo web interface however ssl access by EAS clients will not be affected. It will kill DAV client access, but I don't use that. If you do there is probably a way to selectively permit that, but I didn't go that far.

Hope this helps someone with a similar issue.