Block the legacy MSOnline PowerShell module from the tenant

Description

The tenant authorization policy has blockMsolPowerShell set to true. Authentication requests from the MSOnline (MSOL) PowerShell module, and user-based access to the legacy endpoint it uses, are refused. Administration is done with the Microsoft Graph PowerShell SDK or the admin centers.

Review the sign-in logs for the application Azure Active Directory PowerShell or the MSOnline client before blocking, to find remaining users of the module.

Rationale

The MSOnline and AzureAD modules are retired and no longer receive fixes. They rely on a legacy endpoint that predates some current controls and is less watched by defenders, and attack tools still use them to enumerate and change the directory. Blocking them removes an access path nobody should need any more.

Impact

Old scripts and tools that still call MSOnline cmdlets (Connect-MsolService, Get-MsolUser...) stop working and must be migrated to Microsoft Graph PowerShell. Microsoft Entra Connect and Microsoft Graph are not affected.

Setting

Audit

1. In PowerShell (Microsoft Graph, scope Policy.Read.All, role at least Global Reader): Get-MgPolicyAuthorizationPolicy | Select-Object BlockMsolPowerShell or Graph GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy.
2. Check that BlockMsolPowerShell is True.
3. Fail if it is False or empty.

Remediation

1. Search the sign-in logs (Entra ID > Monitoring & health > Sign-in logs, filter on the application) for recent MSOnline use and migrate those scripts to Microsoft Graph PowerShell.
2. In PowerShell (Microsoft Graph, scope Policy.ReadWrite.Authorization, role Privileged Role Administrator or Global Administrator): Update-MgPolicyAuthorizationPolicy -BodyParameter @{ blockMsolPowerShell = $true } or Graph PATCH https://graph.microsoft.com/v1.0/policies/authorizationPolicy with {"blockMsolPowerShell": true}.
3. Check that Connect-MsolService now fails from an admin workstation.

Rollback

Run the same command with blockMsolPowerShell = $false.

References

• authorizationPolicy resource type Microsoft, vendor-doc, accessed 2026-10-24
• Update-MgPolicyAuthorizationPolicy Microsoft, vendor-doc, accessed 2026-10-24
• Maester MT.1185 - Block legacy MSOnline (MSOL) PowerShell module Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-010 Disable per-user MFA for every user
• related CB-M365-APPS-017 Require assignment for high-privilege Microsoft administration tools

People and lifecycle