Block legacy authentication protocols to SharePoint and OneDrive

Description

SharePoint Online refuses authentication through legacy protocols. Two tenant settings are off:

• LegacyAuthProtocolsEnabled: Identity Client Runtime Library (IDCRL), forms-based authentication and the SharePointOnlineCredentials class used by old Office clients, scripts and third-party tools;
• LegacyBrowserAuthProtocolsEnabled: the Relying Party Suite (RPS) browser protocol.

In the SharePoint admin center this is the Apps that don't use modern authentication setting set to Block access. Baseline security mode exposes the same two settings.

Rationale

Legacy protocols send a user name and password to the service and cannot carry a multifactor challenge or a device claim. They are the usual path for password spraying and credential stuffing against SharePoint, and they bypass Conditional Access policies that require MFA or a managed device, including the SharePoint unmanaged device restrictions.

Impact

Office clients older than Office 2013, scripts that sign in with SharePointOnlineCredentials and third-party tools that store a password stop working. Rewrite scripts with an app registration (certificate) or a delegated modern sign-in. The change can take up to 24 hours. Microsoft deprecated RPS browser authentication for enterprise tenants in October 2025: LegacyBrowserAuthProtocolsEnabled can no longer be set to True.

Setting

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Access control > Apps that don't use modern authentication.
3. Check that Block access is selected.
4. Read-only alternative: as a Global Reader, call Microsoft Graph GET https://graph.microsoft.com/v1.0/admin/sharepoint/settings (permission SharePointTenantSettings.Read.All, or Get-MgAdminSharepointSetting) and check that isLegacyAuthProtocolsEnabled is false. With the SharePoint Online Management Shell (requires SharePoint Administrator), run Get-SPOTenant | Select-Object LegacyAuthProtocolsEnabled, LegacyBrowserAuthProtocolsEnabled.
5. Fail if Allow access is selected or if either property is True.

Remediation

1. Find who still uses legacy protocols: the Baseline security mode page in the Microsoft 365 admin center (Settings > Org settings > Security and Privacy > Baseline Security Mode) offers an impact report for the IDCRL and RPS settings. The SharePoint sign-in events in the Entra sign-in logs (Client app filter on legacy clients) give the same view.
2. Move the remaining scripts and tools to modern authentication.
3. In the SharePoint admin center, browse to Policies > Access control > Apps that don't use modern authentication, select Block access and Save. Role: SharePoint Administrator.
4. PowerShell equivalent: Set-SPOTenant -LegacyAuthProtocolsEnabled $false -LegacyBrowserAuthProtocolsEnabled $false. Graph equivalent: PATCH /admin/sharepoint/settings with {"isLegacyAuthProtocolsEnabled": false}.

Rollback

Run Set-SPOTenant -LegacyAuthProtocolsEnabled $true while a client is migrated. The RPS setting can no longer be turned back on.

References

• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24
• Control access from unmanaged devices Microsoft, vendor-doc, accessed 2026-10-24
• sharepointSettings resource type (Microsoft Graph) Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-015 Limit SharePoint and OneDrive to web-only access from unmanaged devices
• related CB-M365-AUTH-001 Block legacy authentication with Conditional Access

People and lifecycle