{
  "id": "CB-M365-AUTH-046",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-046",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-046.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-046.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-046",
    "title": "Block the legacy MSOnline PowerShell module from the tenant",
    "finding": {
      "title": "The retired MSOnline PowerShell module can still authenticate to the tenant",
      "description": "An unsupported administration path, less visible than Microsoft Graph, stays open to anyone holding an admin password."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "powershell",
      "msonline",
      "legacy",
      "administration"
    ],
    "description": "The tenant authorization policy has `blockMsolPowerShell` set to `true`. Authentication requests\nfrom the MSOnline (MSOL) PowerShell module, and user-based access to the legacy endpoint it uses,\nare refused. Administration is done with the Microsoft Graph PowerShell SDK or the admin centers.\n",
    "rationale": "The MSOnline and AzureAD modules are retired and no longer receive fixes. They rely on a legacy\nendpoint that predates some current controls and is less watched by defenders, and attack tools\nstill use them to enumerate and change the directory. Blocking them removes an access path nobody\nshould need any more.\n",
    "impact": "Old scripts and tools that still call MSOnline cmdlets (`Connect-MsolService`, `Get-MsolUser`...)\nstop working and must be migrated to Microsoft Graph PowerShell. Microsoft Entra Connect and\nMicrosoft Graph are not affected.\n",
    "notes": "Review the sign-in logs for the application **Azure Active Directory PowerShell** or the MSOnline\nclient before blocking, to find remaining users of the module.\n",
    "setting": {
      "location": "Microsoft Graph > policies/authorizationPolicy > blockMsolPowerShell",
      "default_value": "false (on most tenants)",
      "recommended_value": "true"
    },
    "audit": {
      "manual": "1. In PowerShell (Microsoft Graph, scope `Policy.Read.All`, role at least Global Reader):\n   `Get-MgPolicyAuthorizationPolicy | Select-Object BlockMsolPowerShell`\n   or Graph `GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy`.\n2. Check that `BlockMsolPowerShell` is `True`.\n3. Fail if it is `False` or empty.\n"
    },
    "remediation": {
      "manual": "1. Search the sign-in logs (**Entra ID** > **Monitoring & health** > **Sign-in logs**, filter\n   on the application) for recent MSOnline use and migrate those scripts to Microsoft Graph\n   PowerShell.\n2. In PowerShell (Microsoft Graph, scope `Policy.ReadWrite.Authorization`, role Privileged Role\n   Administrator or Global Administrator):\n   `Update-MgPolicyAuthorizationPolicy -BodyParameter @{ blockMsolPowerShell = $true }`\n   or Graph `PATCH https://graph.microsoft.com/v1.0/policies/authorizationPolicy` with\n   `{\"blockMsolPowerShell\": true}`.\n3. Check that `Connect-MsolService` now fails from an admin workstation.\n",
      "rollback": "Run the same command with `blockMsolPowerShell = $false`.\n"
    },
    "references": [
      {
        "title": "authorizationPolicy resource type",
        "url": "https://learn.microsoft.com/graph/api/resources/authorizationpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Update-MgPolicyAuthorizationPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.graph.identity.signins/update-mgpolicyauthorizationpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester MT.1185 - Block legacy MSOnline (MSOL) PowerShell module",
        "url": "https://maester.dev/docs/tests/MT.1185",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1059.001"
      },
      {
        "framework": "mitre-attack",
        "id": "T1087.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-010",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-017",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}