{ "id": "CB-M365-AUTH-001", "standard": "m365", "version": "main", "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-001", "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-001.json", "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-001.yml", "profiles_effective": [ "baseline", "hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-M365-AUTH-001", "title": "Block legacy authentication with Conditional Access", "finding": { "title": "Legacy authentication protocols are not blocked", "description": "Clients that use IMAP, POP3, SMTP AUTH, Exchange ActiveSync basic authentication or other legacy protocols sign in with a password alone, so MFA never applies to them." }, "status": "active", "profiles": [ "baseline" ], "risk": { "severity": "high" }, "assessment": "manual", "tags": [ "legacy-authentication", "conditional-access", "password-spray", "mfa-bypass" ], "applicability": { "requires": [ "Microsoft Entra ID P1" ] }, "description": "A Conditional Access policy blocks every sign-in that comes from a legacy authentication client,\nfor all users and all resources. In Conditional Access, legacy clients are the **Exchange\nActiveSync clients** and **Other clients** client app types: IMAP, POP3, authenticated SMTP,\nMAPI over HTTP, Exchange Web Services and Autodiscover with basic authentication, older Office\nclients and similar protocols that cannot carry an MFA challenge.\n\nThe policy excludes only the emergency access accounts. Microsoft can also create a\nMicrosoft-managed policy named **Block legacy authentication**, and Baseline security mode\ncreates one from the Microsoft 365 admin center: either satisfies this control once it is **On**\nand covers the same scope.\n", "rationale": "Legacy protocols accept a user name and password and nothing else. Password spray and credential\nstuffing campaigns use them precisely because a stolen or guessed password is enough, whatever MFA\npolicy the tenant has. Blocking them at the identity provider closes the bypass for every\nworkload at once, including protocols a workload still accepts.\n", "impact": "Applications, scripts, printers and scanners that still send mail or read mailboxes with basic\nauthentication stop working. Before enforcing, list them from the sign-in logs (filter **Client\napp** on the legacy values, interactive and non-interactive) and move them to modern\nauthentication, OAuth for SMTP, or a connector. Old Office clients (2010 and earlier) can no\nlonger sign in.\n", "audit": { "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** set to **On** (not Report-only) where:\n - **Users** > **Include** is **All users**, and **Exclude** contains only the emergency\n access accounts or their group;\n - **Target resources** includes **All resources**, without exclusions;\n - **Conditions** > **Client apps** is configured with only **Exchange ActiveSync clients**\n and **Other clients** selected;\n - **Grant** is **Block access**.\n A Microsoft-managed or Baseline security mode policy named **Block legacy authentication**\n counts if it meets the same criteria.\n4. Browse to **Entra ID** > **Monitoring & health** > **Sign-in logs**, add the **Client app**\n filter with the legacy values and check, on both the interactive and non-interactive tabs,\n that recent attempts show **Failure** with the policy listed under **Conditional Access**.\n5. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.ClientAppTypes -contains 'other' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}`\n6. Fail if no such policy exists, if it is Report-only or Off, if it does not cover all users\n and all resources, or if exclusions go beyond the emergency access accounts.\n" }, "remediation": { "manual": "1. In **Entra ID** > **Monitoring & health** > **Sign-in logs**, filter **Client app** on the\n legacy values for the last 30 days and fix or retire every client found.\n2. As at least a Conditional Access Administrator, browse to **Entra ID** >\n **Conditional Access** > **Policies** and select **New policy**. If a Microsoft-managed\n **Block legacy authentication** policy exists, you can enable it instead after checking its\n exclusions.\n3. Name it, for example `ALL - Block legacy authentication`.\n4. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts.\n5. **Target resources** > **Resources** > **Include**: **All resources**.\n6. **Conditions** > **Client apps**: set **Configure** to **Yes**, select only **Exchange\n ActiveSync clients** and **Other clients**.\n7. **Grant**: **Block access**.\n8. Set **Enable policy** to **Report-only**, save, and review the sign-in logs for a week with\n the **Report-only** result filter.\n9. Switch **Enable policy** to **On**.\nGraph equivalent: `New-MgIdentityConditionalAccessPolicy` with `conditions.clientAppTypes`\nset to `exchangeActiveSync` and `other` and `grantControls.builtInControls` set to `block`.\n", "rollback": "Set the policy to **Report-only** or **Off**, or exclude a dedicated group holding the service\naccounts that still need legacy authentication while they are migrated.\n" }, "references": [ { "title": "Block legacy authentication with Conditional Access", "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Microsoft-managed policies", "url": "https://learn.microsoft.com/entra/identity/conditional-access/managed-policies", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Baseline security mode settings", "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/baseline-security-mode-settings", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "CISA SCuBA Microsoft Entra ID baseline", "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md", "publisher": "CISA", "kind": "standard", "accessed": "2026-10-24" } ], "mappings": [ { "framework": "cisa-scuba-m365", "framework_version": "2.0.0", "id": "MS.AAD.1.1v1", "relation": "equivalent" }, { "framework": "anssi-mfa", "framework_version": "2.0", "id": "R11", "relation": "related", "note": "ANSSI asks for authentication over a protected channel; blocking protocols that send a bare password is one part of it." }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "IA-2(1)", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "IA-2(2)", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "CM-7", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1110.003" }, { "framework": "mitre-attack", "id": "T1078.004" } ], "related_controls": [ { "id": "CB-M365-AUTH-003", "type": "related" }, { "id": "CB-M365-AUTH-002", "type": "related" }, { "id": "CB-M365-ADMIN-002", "type": "related" }, { "id": "CB-M365-MAIL-009", "type": "related" }, { "id": "CB-M365-COLLAB-001", "type": "related" }, { "id": "CB-M365-AUTH-034", "type": "related" }, { "id": "CB-M365-MAIL-006", "type": "related" }, { "id": "CB-M365-MAIL-011", "type": "related" }, { "id": "CB-M365-DEVICE-012", "type": "related" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "introduced_in": "0.1.0", "created": "2026-10-24", "updated": "2026-10-24" } }