Block legacy authentication for all users¶
Licence and role
Microsoft Entra ID P1 (included in Microsoft 365 Business Premium, E3 and E5).
Why it matters¶
Legacy protocols (IMAP, POP, SMTP AUTH from old clients, Exchange ActiveSync with basic credentials) cannot do MFA, so a stolen password is enough. A single Block policy on the legacy client app types closes that path.
Steps¶
- Run the read-only check: it lists block policies on legacy client types and groups the last 7 days of sign-ins by client app.
- New policy: Users = All users, exclude EmergencyAccess and any service account you still have to migrate. Target resources = All resources.
- Conditions > Client apps > Configure = Yes; select only Exchange ActiveSync clients and Other clients. Grant = Block access. Enable policy = Report-only.
- Review report-only results for 7 days, move the remaining apps to modern authentication, then switch to On.
Impact on users¶
Apps and devices that sign in with legacy protocols stop working (old mail clients, scanners using SMTP AUTH with basic credentials, scripts).
Rollback¶
Set the policy to Report-only or Off; add a temporary exclusion for one account while it is migrated.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.SignIns, .Reports, .Identity.DirectoryManagement).
Connect first:
Connect-MgGraph -Scopes Policy.Read.All,AuditLog.Read.All,UserAuthenticationMethod.Read.All,Directory.Read.All
Role: Global Reader or Security Reader is enough for these reads.
$p = Get-MgIdentityConditionalAccessPolicy -All
$b = $p | Where-Object { $_.GrantControls.BuiltInControls -contains 'block' -and ($_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' -or $_.Conditions.ClientAppTypes -contains 'other') }
"Legacy-auth block policies: $(@($b).Count)"
$b | ForEach-Object { "$($_.DisplayName) | $($_.State)" }
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString('yyyy-MM-ddTHH:mm:ssZ')
Get-MgAuditLogSignIn -Filter "createdDateTime ge $since" -Top 1000 | Group-Object ClientAppUsed | Sort-Object Count -Descending | ForEach-Object { "Client app '$($_.Name)': $($_.Count) sign-ins (last 7 days, first 1000)" }
How to verify¶
A legacy-auth block policy is On; the sign-in logs show no successful sign-ins with Exchange ActiveSync or Other clients.
Sources¶
This control is in the Conditional Access Baseline Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 20 controls.