{
  "id": "CB-M365-COLLAB-001",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-001",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-001.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-001.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-001",
    "title": "Block legacy authentication protocols to SharePoint and OneDrive",
    "finding": {
      "title": "SharePoint and OneDrive accept legacy authentication protocols",
      "description": "Clients using IDCRL or other non-modern protocols can reach files with a password alone, outside multifactor authentication and Conditional Access."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "legacy-authentication",
      "sharepoint",
      "onedrive",
      "mfa"
    ],
    "description": "SharePoint Online refuses authentication through legacy protocols. Two tenant settings are off:\n\n- `LegacyAuthProtocolsEnabled`: Identity Client Runtime Library (IDCRL), forms-based authentication\n  and the `SharePointOnlineCredentials` class used by old Office clients, scripts and third-party\n  tools;\n- `LegacyBrowserAuthProtocolsEnabled`: the Relying Party Suite (RPS) browser protocol.\n\nIn the SharePoint admin center this is the **Apps that don't use modern authentication** setting set\nto **Block access**. Baseline security mode exposes the same two settings.\n",
    "rationale": "Legacy protocols send a user name and password to the service and cannot carry a multifactor\nchallenge or a device claim. They are the usual path for password spraying and credential stuffing\nagainst SharePoint, and they bypass Conditional Access policies that require MFA or a managed\ndevice, including the SharePoint unmanaged device restrictions.\n",
    "impact": "Office clients older than Office 2013, scripts that sign in with `SharePointOnlineCredentials` and\nthird-party tools that store a password stop working. Rewrite scripts with an app registration\n(certificate) or a delegated modern sign-in. The change can take up to 24 hours. Microsoft\ndeprecated RPS browser authentication for enterprise tenants in October 2025:\n`LegacyBrowserAuthProtocolsEnabled` can no longer be set to `True`.\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Access control > Apps that don't use modern authentication",
      "default_value": "Allow access (LegacyAuthProtocolsEnabled = True)",
      "recommended_value": "Block access (LegacyAuthProtocolsEnabled = False, LegacyBrowserAuthProtocolsEnabled = False)"
    },
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Access control** > **Apps that don't use modern authentication**.\n3. Check that **Block access** is selected.\n4. Read-only alternative: as a Global Reader, call Microsoft Graph\n   `GET https://graph.microsoft.com/v1.0/admin/sharepoint/settings` (permission\n   `SharePointTenantSettings.Read.All`, or `Get-MgAdminSharepointSetting`) and check that\n   `isLegacyAuthProtocolsEnabled` is `false`. With the SharePoint Online Management Shell (requires\n   SharePoint Administrator), run\n   `Get-SPOTenant | Select-Object LegacyAuthProtocolsEnabled, LegacyBrowserAuthProtocolsEnabled`.\n5. Fail if **Allow access** is selected or if either property is `True`.\n"
    },
    "remediation": {
      "manual": "1. Find who still uses legacy protocols: the Baseline security mode page in the Microsoft 365 admin\n   center (**Settings** > **Org settings** > **Security and Privacy** > **Baseline Security Mode**)\n   offers an impact report for the IDCRL and RPS settings. The SharePoint sign-in events in the\n   Entra sign-in logs (**Client app** filter on legacy clients) give the same view.\n2. Move the remaining scripts and tools to modern authentication.\n3. In the SharePoint admin center, browse to **Policies** > **Access control** > **Apps that don't\n   use modern authentication**, select **Block access** and **Save**. Role: SharePoint\n   Administrator.\n4. PowerShell equivalent:\n   `Set-SPOTenant -LegacyAuthProtocolsEnabled $false -LegacyBrowserAuthProtocolsEnabled $false`.\n   Graph equivalent: `PATCH /admin/sharepoint/settings` with\n   `{\"isLegacyAuthProtocolsEnabled\": false}`.\n",
      "rollback": "Run `Set-SPOTenant -LegacyAuthProtocolsEnabled $true` while a client is migrated. The RPS setting\ncan no longer be turned back on.\n"
    },
    "references": [
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Baseline security mode settings",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/baseline-security-mode-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Control access from unmanaged devices",
        "url": "https://learn.microsoft.com/sharepoint/control-access-from-unmanaged-devices",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "sharepointSettings resource type (Microsoft Graph)",
        "url": "https://learn.microsoft.com/graph/api/resources/sharepointsettings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(1)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-17(2)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-015",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}