setup example
microsoft 365: block legacy authentication
Old mail protocols cannot ask for a second factor, so an attacker can use them to get around yours. Find who still uses them, then block them with a Conditional Access policy that starts in report-only mode.
what it is and when it fits
Legacy authentication is any sign-in made by a client that does not use modern authentication, such as an Office 2010 client, or by older mail protocols such as IMAP, SMTP and POP3. These protocols do not support multifactor authentication. Even with a second factor required, an attacker can sign in with an older protocol and skip it.
Microsoft says its own analysis shows that more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication, and that these attacks would stop with basic authentication blocked. Those are vendor figures, and they show where Microsoft sees the risk.
The block takes one policy. The work is finding what still depends on the old route before you close it.
fits: A company that has, or is about to turn on, multifactor authentication on Microsoft 365 and still has older mail clients, devices or scripts that sign in with a stored password.
before you start
- licence
- A Conditional Access policy needs at least Microsoft Entra ID P1. Without a licence that includes Conditional Access, Microsoft says to use security defaults, which block legacy authentication.
- roles
- At least Reports Reader to read the sign-in logs, and at least Conditional Access Administrator to create the policy.
- first
- Set up the emergency access accounts and the group that holds them, so that the policy can exclude them.
the steps, in this order
closing the sign-in route that skips the second factor
- 1findsign-in logs, interactive and non-interactive
- 2fixmodern authentication, or a managed identity for a service account
- 3report-onlya block policy that only records the impact
- 4switch onor stage it with groups first
- 5keep watchinglegacy attempts now show as blocked
every exclusion gets an owner and an end date
basis Microsoft Learn, block legacy authentication. The order is practice.
- find who still uses legacy authenticationAdd the Client App column to the sign-in logs, filter on all of the legacy authentication protocols and apply the filter. Do the same on the User sign-ins (non-interactive) tab. The Client App field on each attempt shows which protocol was used. Microsoft also offers a workbook named Sign-ins using legacy authentication to help sort this out.
Entra admin center > Entra ID > Monitoring & health > Sign-in logs - fix or retire each oneMove mail clients to modern authentication. Where scripts or code use a service account to sign in, Microsoft suggests replacing it with a managed identity.
- create the policy in report-only modeGive it a meaningful name. Under Users, include All users and exclude the emergency access group and any account that must keep using legacy authentication. Under Target resources, include All resources. Under Conditions > Client apps, set Configure to Yes and tick only Exchange ActiveSync clients and Other clients. Under Grant, select Block access. Set Enable policy to Report-only.
Entra admin center > Entra ID > Conditional Access > Policies > New policy - read the report-only resultsUse the policy impact or report-only results to see who would have been blocked, and go back to step two for each of them.
- switch it on, or stage itMove Enable policy from Report-only to On. Microsoft also describes a staged rollout, where you add specific groups and exclude others first.
- no Conditional Access licenceUse security defaults. They block legacy authentication and need no licence.the sign-in baseline page →
basis Microsoft Learn, block legacy authentication with Conditional Access, read on 2 November 2026. The order of the steps is practice.
how to tell it worked
- Filter the sign-in logs on the legacy client apps again after the policy is on. New attempts should show as blocked.
- Check that the emergency accounts can still sign in.
- Ask the owners of the shared mailboxes, the printers and the line-of-business apps whether anything stopped sending or receiving mail.
what goes wrong
turning it on before reading the sign-ins
Phones, copiers and old apps that use a stored password stop working at once. The report-only step exists to show you who they are.
service accounts and service principals
Microsoft says calls made by service principals are not blocked by Conditional Access policies scoped to users, and that you need Conditional Access for workload identities to cover them. Service accounts in scripts are better replaced with managed identities.
no exclusion for the emergency accounts
A misconfigured policy can lock everyone out, including administrators. Microsoft recommends excluding emergency access accounts so that one of them can still sign in and recover access.
treating the policy as the first line of defense
Microsoft notes that Conditional Access policies are enforced after first-factor authentication is completed, and that they are not meant to be the first line of defense against attacks such as denial of service. Keep it as one layer.
the evidence it leaves
| show | owner | refresh |
|---|---|---|
| the policy settings, exported or captured with the date | head of IT | when it changes, and checked quarterly |
| the report-only results from before the policy was switched on | head of IT | once, then kept |
| the list of exclusions, each with an owner, a reason and an end date | head of IT | quarterly |
| a sign-in log sample that shows legacy attempts blocked | head of IT | quarterly |
basis practice. The rhythms are your choice.
the controls and rules it serves
- multi-factor authenticationA second factor only protects an account if the sign-in route that skips it is closed.
- logging and monitoringThe sign-in logs are where legacy use is found before the block and confirmed after it.
This page describes what the platform's maker documents for this one platform. It does not say the platform is the right choice for your company, and the same control exists elsewhere.
check it yourself
your next step
Run the legacy sign-in filter today and count the accounts and devices that appear.