You can roll out MFA to everyone and still get breached through the side door. Legacy authentication, the old protocols like basic auth over IMAP, POP, SMTP AUTH, and older Exchange ActiveSync, predates modern auth and simply can't prompt for a second factor. An attacker with a leaked password uses one of these, and your MFA never fires. Blocking legacy auth is one of the highest-value things on any hardening list, and it's free on every tenant. The risk is breaking the one scanner or app still relying on it, which is why you find it first.
Step 1: Find what's still using it
Before you block anything, look at the sign-in logs. Entra admin center → Sign-in logs, then filter Client app to the legacy categories (Exchange ActiveSync, Other clients, IMAP, POP, SMTP, MAPI). What you see is your real exposure, usually a mix of:
- A multifunction printer or scanner sending scan-to-email over SMTP AUTH
- A line-of-business app with mailbox credentials hard-coded in
- An ancient Outlook build or a personal phone's stock mail app
- Attackers, failing against accounts, which is the point
Step 2: Fix the legitimate users first
Everything you found in step 1 that's real needs a modern path before you block:
| What it is | Modern replacement |
|---|---|
| Scan-to-email printer | Move to SMTP client submission with a dedicated account, or better, Graph/High Volume Email, or an internal relay |
| Old Outlook | Update to a current build that uses modern auth |
| Phone stock mail app | Switch to the Outlook mobile app |
| App with stored credentials | Re-point to modern auth or Graph with an app registration |
Step 3: Block with Conditional Access, report-only first
Create a Conditional Access policy: all users, all cloud apps, condition = client apps: Exchange ActiveSync clients + other clients, grant = Block. Set it to Report-only and leave it a week.
- Exclude your break-glass accounts from this policy, like every blocking policy.
- Report-only shows you exactly who would be blocked, in the sign-in logs under the policy's result column, without actually blocking anyone.
- When the only hits left are things you expect (attackers and nothing legitimate), flip it to On.
Step 4: Close the door at the protocol level too
Conditional Access blocks at sign-in; you can also disable the protocols themselves per mailbox for defence in depth:
Connect-ExchangeOnline
# Disable POP and IMAP org-wide for new mailboxes
Get-CASMailboxPlan | Set-CASMailboxPlan -PopEnabled $false -ImapEnabled $false
# Turn off SMTP AUTH at the org level (override per-mailbox only where needed)
Set-TransportConfig -SmtpClientAuthenticationDisabled $trueLeave SMTP AUTH enabled only on the specific mailbox a verified device needs, not org-wide.
Verify
- Re-check the sign-in logs after a few days: legacy client-app sign-ins should be failing with the CA policy as the reason.
- Confirm your remediated printer/app is now showing as modern auth, not just gone.
- Re-run your security assessment tool; this moves the needle on Secure Score and most baseline checks.
Frequently asked questions
What is legacy authentication in Microsoft 365?
Legacy authentication is the set of older sign-in protocols — IMAP, POP, SMTP AUTH, older Exchange ActiveSync, and basic auth — that can't perform MFA. An attacker with a stolen password uses one of them to bypass MFA entirely, which is why they're a common attack path.
How do I find what's still using legacy auth before I block it?
Filter the Entra sign-in logs by the legacy Client app categories (Exchange ActiveSync, Other clients, IMAP, POP, SMTP, MAPI). You'll usually find scan-to-email printers, old Outlook builds, and apps with stored credentials — remediate those before you block.
Will blocking legacy auth break my printer's scan-to-email?
It can, which is why you block it in Conditional Access report-only mode first. Move the printer to modern SMTP client submission with a dedicated account, or an internal relay, then switch the policy on once the only remaining hits are attackers.