What this check looks at
Checks that SharePoint and OneDrive refuse apps that sign in without modern authentication.
SharePoint and OneDrive can be reached by apps that sign in with modern authentication (OAuth, which supports MFA and Conditional Access) or, for compatibility, by older apps that send a username and password directly. Legacy authentication is used by Office 2010 and earlier, some WebDAV and old sync tools and old scripts. The SharePoint setting Apps that don’t use modern authentication decides whether those apps are allowed.
This check reads that setting (LegacyAuthProtocolsEnabled). The check fails when SharePoint and OneDrive still accept legacy authentication.
Legacy authentication cannot do MFA, so it is how password spraying and stolen passwords reach files even where Conditional Access requires MFA elsewhere. Unless something else blocks legacy authentication, an attacker with a password can point a legacy client at SharePoint and download files without a second factor.
Why it matters
Legacy sign-in sends a plain password and cannot do MFA, so it is how password-spraying reaches files even where Conditional Access requires MFA everywhere else.
A typical case: a 60-person firm enforces MFA through Conditional Access but never blocked legacy authentication. Attackers spraying common passwords find one that works and point an old WebDAV client at SharePoint, which accepts the password alone. They download the finance and HR libraries over a weekend, and the MFA policy never comes into play.
Current Office apps, the OneDrive sync app and browsers are unaffected by blocking legacy authentication. Only very old Office versions and tools are, and those are unsupported anyway.
CIS Microsoft 365 Foundations Benchmark 7.2.1 asks for modern authentication to be required for SharePoint applications. CIS Controls v8 safeguards 6.3 and 4.8, ISO 27001 A.8.5, the NCSC CAF identity and secure configuration outcomes and NIST CSF PR.AA-03 support it.
How to fix it
Where: SharePoint admin centre → Policies → Access control
Before you start
- Check the sign-in logs for SharePoint sign-ins from legacy clients (Office 2010 or earlier, WebDAV tools, old sync apps) and update them first.
Step by step
- Look for legacy clients. In the Microsoft Entra admin centre, Entra ID > Monitoring & health > Sign-in logs, filter Application on Office 365 SharePoint Online and Client app on the legacy authentication clients (Other clients and the other legacy entries) for the last 30 days. Note the users and devices.
- Update what you find. Upgrade any Office 2013 or older installation to Microsoft 365 Apps, replace old sync and WebDAV tools with the OneDrive sync app, and move scripts to PnP PowerShell or Microsoft Graph with modern sign-in.
- Block legacy authentication in SharePoint. In the SharePoint admin centre, go to Policies > Access control > Apps that don’t use modern authentication, select Block access and Save. The change can take up to 24 hours to apply everywhere.
- Or set it with PowerShell. In the SharePoint Online Management Shell run Connect-SPOService -Url https://<tenant>-admin.sharepoint.com, then Set-SPOTenant -LegacyAuthProtocolsEnabled $false.
- Block legacy authentication tenant-wide as well. If no Conditional Access policy blocks legacy authentication for everything, create one (Entra ID > Conditional Access: All users except the emergency access accounts, All resources, Conditions > Client apps: Exchange ActiveSync clients and Other clients, Grant: Block access), starting in report-only mode. See the legacy authentication finding.
- Confirm the setting. Run Get-SPOTenant | Select-Object LegacyAuthProtocolsEnabled and check it shows False. The finding clears at the next assessment.
With PowerShell
Set-SPOTenant -LegacyAuthProtocolsEnabled $false
What users will notice
Very old Office versions and tools that sign in with a password can no longer open SharePoint or OneDrive files.
How to confirm it worked
Get-SPOTenant shows LegacyAuthProtocolsEnabled as False.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Multi-factor authentication test on cloud services |
| NCSC CAF | B2.a Identity verification, authentication and authorisationB4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.4.3 MFA for all remote network access |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor Authentication |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CIS M365 | 7.2.1 Ensure modern authentication for SharePoint applications is required |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1)4.8 Uninstall or disable unnecessary services on enterprise assets and software (IG2) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Control access from apps that don’t use modern authentication (Microsoft Learn)