What this check looks at
Checks for an enabled Conditional Access policy that blocks legacy authentication clients (Exchange ActiveSync and "other clients" such as IMAP, POP and SMTP AUTH).
Legacy authentication is the older way apps and devices sign in to Microsoft 365: the client sends the user name and password with each request, through protocols such as POP, IMAP, authenticated SMTP, older Exchange ActiveSync clients and older Office clients. Conditional Access groups these as Exchange ActiveSync clients and Other clients. None of them can show an MFA prompt, so a sign-in through them is a password and nothing else.
The check passes when security defaults are on (they block legacy authentication), or when an enabled Conditional Access policy targets All users, includes both the Exchange ActiveSync clients and Other clients client app types, and blocks access. It warns when a policy blocks only one of the two types or only some users, and fails when nothing blocks legacy authentication and security defaults are off.
Password-spray tools favour legacy protocols because the server answers at once whether the password is right, with no MFA in the way. Microsoft has retired basic authentication for most Exchange Online protocols, but whatever remains reachable, or is reopened for a scanner or an old app, makes every MFA policy in the tenant optional for an attacker who holds the password.
Why it matters
Legacy protocols cannot present a second factor. While any of them remain reachable, an attacker with a stolen password bypasses every MFA policy in the tenant — the control is effectively optional.
In a typical incident, an attacker sprays a handful of common passwords such as Summer2026! against every mailbox over IMAP or SMTP. One account answers, and the attacker reads and sends mail from it without ever seeing an MFA prompt, even though the person had registered MFA and the tenant had an MFA policy. The mailbox is then used to send phishing to the firm’s clients from a trusted address.
These incidents are harder to spot because legacy sign-ins look like routine background traffic from a mail app. The clean-up costs the same as any mailbox compromise: incident response, warning clients, and assessing whether the breach must be reported to the ICO under UK GDPR. Blocking legacy protocols removes the route entirely.
The CIS Microsoft 365 Foundations Benchmark (5.2.2.3) and the CISA SCuBA baseline (MS.AAD.1.1v1) both ask for legacy authentication to be blocked with Conditional Access. Cyber Essentials requires MFA on cloud services and asks for insecure defaults to be turned off, which legacy protocols undermine. The rule maps to NIST CSF 2.0 PR.AA-03.
How to fix it
Where: Entra admin centre → Protection → Conditional Access
Before you start
- Check the sign-in logs for legacy clients: filter Client app on "Exchange ActiveSync", "IMAP", "POP", "SMTP" and "Other clients" over the last 30 days.
- Move anything still using them (old phones, scanners sending by SMTP, line-of-business apps) to modern authentication or to a dedicated SMTP relay first.
- Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
- Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.
Step by step
- Find what still uses legacy authentication. In the Microsoft Entra admin centre, go to Entra ID > Monitoring & health > Sign-in logs. Set the date range to the last 30 days, add the filter Client app and tick every option under Legacy Authentication Clients. Check both the interactive and non-interactive user sign-in tabs. Note each account, app and IP address that appears.
- Move each one to modern authentication. Typical results are multifunction printers sending scan-to-email by authenticated SMTP, old phone mail apps, and line-of-business apps reading a mailbox over IMAP. Point scanners at an Exchange Online connector or an SMTP relay, move people to Outlook for iOS and Android or a mail app that uses modern authentication, and ask app vendors for OAuth support. Exclude an account from the policy only when there is no alternative, and then only that one account.
- Turn off SMTP AUTH where it is not needed. In Exchange Online PowerShell (Connect-ExchangeOnline), run Set-TransportConfig -SmtpClientAuthenticationDisabled $true to turn off authenticated SMTP for the organisation. For a mailbox that still needs it, run Set-CASMailbox -Identity scanner@contoso.co.uk -SmtpClientAuthenticationDisabled $false. Check with Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled.
- Confirm the emergency access accounts. Make sure two emergency access accounts exist and are in the group you exclude from Conditional Access, so a mistake in this policy cannot lock every administrator out.
- Create the blocking policy in report-only mode. Go to Entra ID > Conditional Access > Policies > New policy and name it "CA03 – All users – Block legacy authentication". Under Users, include All users and exclude the emergency access group. Under Target resources, include All resources. Under Conditions > Client apps, set Configure to Yes and tick only Exchange ActiveSync clients and Other clients. Under Grant, choose Block access. Set Enable policy to Report-only and select Create.
- Check the report-only results. After a few days, filter the sign-in logs on Legacy Authentication Clients again and open the Report-only tab of each entry: anything the policy would block shows as a failure. Each should be a device or app you have already moved, or an attacker’s attempt.
- Switch the policy on. Set Enable policy to On and select Save. Tell the service desk that old mail apps and scanners sending a password directly will now fail, and how to move them to a supported method.
- Confirm the block. Over the next day or two, filter the sign-in logs on Legacy Authentication Clients: new attempts should show Failure with this policy listed on the Conditional Access tab, and nothing business-critical should appear. Re-run the assessment to confirm the finding passes.
What users will notice
Old mail apps and devices that send a password directly (POP, IMAP, older ActiveSync clients, basic SMTP) can no longer sign in. Current Outlook and mobile apps are unaffected.
How to confirm it worked
Filter the sign-in logs on legacy client apps: new attempts should show "Failure" with the blocking policy listed, and nothing business-critical should appear.
Frameworks and controls
This check maps to controls in 19 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | Secure configuration |
| Cyber Essentials Plus | Multi-factor authentication test on cloud servicesSecure configuration |
| NCSC CAF | B2.a Identity verification, authentication and authorisationB4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9(4)(d) Strong authentication mechanisms |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Identities |
| Secure Score | Enable Conditional Access policies to block legacy authentication |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.4.3 MFA for all remote network access2.2.4 Only necessary services, protocols and functions are enabled |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication3.4.6 Employ the principle of least functionality |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor AuthenticationCM.L2-3.4.6 Least Functionality |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CISA SCuBA | MS.AAD.1.1v1 Legacy authentication blocked |
| CIS M365 | 5.2.2.3 Enable Conditional Access policies to block legacy authentication |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1)4.8 Uninstall or disable unnecessary services on enterprise assets and software (IG2) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Block legacy authentication (Microsoft Learn)