Block legacy authentication with Conditional Access

Description

A Conditional Access policy blocks every sign-in that comes from a legacy authentication client, for all users and all resources. In Conditional Access, legacy clients are the Exchange ActiveSync clients and Other clients client app types: IMAP, POP3, authenticated SMTP, MAPI over HTTP, Exchange Web Services and Autodiscover with basic authentication, older Office clients and similar protocols that cannot carry an MFA challenge.

The policy excludes only the emergency access accounts. Microsoft can also create a Microsoft-managed policy named Block legacy authentication, and Baseline security mode creates one from the Microsoft 365 admin center: either satisfies this control once it is On and covers the same scope.

Rationale

Legacy protocols accept a user name and password and nothing else. Password spray and credential stuffing campaigns use them precisely because a stolen or guessed password is enough, whatever MFA policy the tenant has. Blocking them at the identity provider closes the bypass for every workload at once, including protocols a workload still accepts.

Impact

Applications, scripts, printers and scanners that still send mail or read mailboxes with basic authentication stop working. Before enforcing, list them from the sign-in logs (filter Client app on the legacy values, interactive and non-interactive) and move them to modern authentication, OAuth for SMTP, or a connector. Old Office clients (2010 and earlier) can no longer sign in.

Applies when

Requires: Microsoft Entra ID P1

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On (not Report-only) where:
   • Users > Include is All users, and Exclude contains only the emergency access accounts or their group;
   • Target resources includes All resources, without exclusions;
   • Conditions > Client apps is configured with only Exchange ActiveSync clients and Other clients selected;
   • Grant is Block access. A Microsoft-managed or Baseline security mode policy named Block legacy authentication counts if it meets the same criteria.
4. Browse to Entra ID > Monitoring & health > Sign-in logs, add the Client app filter with the legacy values and check, on both the interactive and non-interactive tabs, that recent attempts show Failure with the policy listed under Conditional Access.
5. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.ClientAppTypes -contains 'other' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}
6. Fail if no such policy exists, if it is Report-only or Off, if it does not cover all users and all resources, or if exclusions go beyond the emergency access accounts.

Remediation

1. In Entra ID > Monitoring & health > Sign-in logs, filter Client app on the legacy values for the last 30 days and fix or retire every client found.
2. As at least a Conditional Access Administrator, browse to Entra ID > Conditional Access > Policies and select New policy. If a Microsoft-managed Block legacy authentication policy exists, you can enable it instead after checking its exclusions.
3. Name it, for example ALL - Block legacy authentication.
4. Users > Include: All users. Exclude: the emergency access accounts.
5. Target resources > Resources > Include: All resources.
6. Conditions > Client apps: set Configure to Yes, select only Exchange ActiveSync clients and Other clients.
7. Grant: Block access.
8. Set Enable policy to Report-only, save, and review the sign-in logs for a week with the Report-only result filter.
9. Switch Enable policy to On. Graph equivalent: New-MgIdentityConditionalAccessPolicy with conditions.clientAppTypes set to exchangeActiveSync and other and grantControls.builtInControls set to block.

Rollback

Set the policy to Report-only or Off, or exclude a dedicated group holding the service accounts that still need legacy authentication while they are migrated.

References

• Block legacy authentication with Conditional Access Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft-managed policies Microsoft, vendor-doc, accessed 2026-10-24
• Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-003 Require MFA for all users on all resources
• related CB-M365-AUTH-002 Enable security defaults on tenants without Microsoft Entra ID P1
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts
• related CB-M365-MAIL-009 Disable SMTP AUTH client submission for the organization
• related CB-M365-COLLAB-001 Block legacy authentication protocols to SharePoint and OneDrive
• related CB-M365-AUTH-034 Keep Conditional Access policies free of broken references and unprotected exclusions
• related CB-M365-MAIL-006 Keep modern authentication enabled for Exchange Online
• related CB-M365-MAIL-011 Disable Exchange Web Services, or restrict it to approved applications
• related CB-M365-DEVICE-012 Block Basic authentication prompts in Microsoft 365 apps

People and lifecycle