Blocking legacy authentication in Microsoft 365
Legacy authentication sends a username and password and nothing else, so MFA never gets a say. Blocking it is one of the highest-value changes in Microsoft 365, as long as you find the printer, script or old mail client that still depends on it first.
Reviewed by the ITRS security team · Last updated
Why legacy authentication bypasses MFA
'Legacy authentication' means sign-ins that use basic authentication: the client sends a username and password with each request. Older Office versions and protocols like POP, IMAP, authenticated SMTP and Exchange ActiveSync on old devices work this way. There is no step where Microsoft can ask for a second factor.
Microsoft states that legacy authentication doesn't support MFA, so even with an MFA policy in place an attacker can use an older protocol and get in with just a password. In its Conditional Access documentation Microsoft reports that more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks it analyzed used legacy authentication.
Microsoft disabled basic authentication for most Exchange Online protocols in 2022 (October 1, 2022 for most cloud environments), but authenticated SMTP submission (SMTP AUTH) has been on a separate track, and sign-in attempts over legacy protocols still reach your tenant and show up in your logs. A Conditional Access block, or security defaults, closes the door at the identity layer regardless of protocol.
Finding legacy sign-ins
Sign-in logs are kept for 7 days on Entra ID Free and 30 days with P1 or P2, so run this check over a full month if you can. Microsoft also publishes a 'Sign-ins using legacy authentication' workbook if logs are sent to Log Analytics.
Open the sign-in logs
In the Microsoft Entra admin centre, as at least a Reports Reader, go to Entra ID > Monitoring & health > Sign-in logs (path per Microsoft Learn, October 2026).
Show the Client App column
Select Columns and add Client App if it isn't displayed.
Filter for legacy protocols
Add a filter on Client App and select all the legacy authentication protocols (for example IMAP4, POP3, Authenticated SMTP, Exchange ActiveSync, Other clients).
Repeat on non-interactive sign-ins
Microsoft specifically says to check the User sign-ins (non-interactive) tab too. Background clients often appear only there.
Separate success from failure
Failed legacy attempts from unfamiliar countries are usually password spray: they're the reason to block. Successful ones are your to-do list: real things that will break.
Scanners, printers and old apps
The successful legacy sign-ins almost always fall into a few groups. Microsoft's guide to setting up multifunction devices and applications describes the supported alternatives:
| What you find | Usual fix |
|---|---|
Scan-to-email from a copier or multifunction printer | Firmware update for OAuth if available; otherwise SMTP relay through an inbound connector authenticated by certificate or your static public IP, or Direct Send for internal-only delivery |
Line-of-business app or script sending alerts | Move to OAuth 2.0 for SMTP, or Microsoft Graph for sending mail; if it only emails internal staff, consider High Volume Email or relay |
Staff using an old Outlook version or a third-party mail app over IMAP/POP | Upgrade to a supported Outlook build or the Outlook mobile app (modern authentication) |
Old iPhone or Android native mail with ActiveSync | Re-add the account so it uses modern authentication, or move to Outlook mobile |
Admin PowerShell scripts using old modules | Update to the current Exchange Online and Microsoft Graph PowerShell modules, which use modern authentication |
Blocking with Conditional Access
With Entra ID P1, Microsoft's documented policy is:
New policy
Entra ID > Conditional Access > Policies > New policy, with a clear name such as 'CA03 - All users - Block legacy authentication'.
Users
Include All users. Exclude your emergency access group and any documented exception group. Microsoft recommends excluding at least one account to avoid locking yourself out through a misconfiguration.
Target resources
Include All resources (formerly 'All cloud apps').
Conditions
Client apps: set Configure to Yes and tick only Exchange ActiveSync clients and Other clients.
Grant
Block access.
Report-only first
Set Enable policy to Report-only, review the impact, then switch to On.
Verifying the block
- Filter sign-in logs for legacy client apps after enforcement. You should see failures with the Conditional Access status showing your block policy, and no new successes outside the exception group.
- Test from a deliberately old client (for example an IMAP client on a test account) and confirm the sign-in is refused.
- Check the non-interactive sign-ins tab again a week later.
- Watch the helpdesk queue for 'scanner stopped emailing' tickets; that is a missed dependency, not a reason to switch the policy off.
Exceptions
Sometimes a device can't be fixed in time. Treat that as a short-term, documented risk: put only that account in an exclusion group, restrict it so it can sign in only from your office's public IP (a separate Conditional Access policy using a named location), give it no mailbox access beyond what it needs, and set an expiry date. Review the exception quarterly until the device is replaced.
Sources: Microsoft Learn, 'Block legacy authentication with Conditional Access', 'Deprecation of Basic authentication in Exchange Online', 'How to set up a multifunction device or application to send email using Microsoft 365' and 'Microsoft Entra data retention'.
Related reading.
- PracticeManaged IT SupportHelpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
- GuideA baseline set of Conditional Access policiesMost small and mid-sized Microsoft 365 tenants need only a handful of well-tested Conditional Access policies.
- GuideSecurity defaults vs Conditional Access in Microsoft 365Both switch on multifactor authentication and block old sign-in protocols.
- GuideInvestigating suspicious sign-ins in Microsoft EntraA strange sign-in alert, a user who says 'I didn't approve that', or a client who received an odd email from your domain: each starts in the Entra sign-in logs.
- ArticleMicrosoft 365 Security Best Practices for 2026Eight settings that close the gaps we find most often in small-business Microsoft 365 tenants, each with where to find it and which licence it needs.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.