How to block legacy authentication in Microsoft 365

← All articles

Legacy authentication is one of the most exploited weaknesses in Microsoft 365 tenants. It sounds technical, but the implication is simple: if you have legacy authentication enabled, attackers can bypass your MFA entirely using a stolen password.

What is legacy authentication?

Legacy authentication refers to older protocols that don't support modern authentication methods like OAuth 2.0. The main ones are:

SMTP AUTH — used by older email clients and some printers/scanners
IMAP — used by older email clients (Thunderbird, older Outlook versions)
POP3 — same as IMAP
Exchange ActiveSync — used by some older mobile devices
Basic Auth — used by older Office versions and some line-of-business apps

These protocols were designed in a time before MFA existed. They authenticate with just a username and password — and Microsoft 365 accepts them even if you have MFA enabled, because the protocol has no mechanism to prompt for a second factor.

The attack is trivial: An attacker buys credentials from a data breach, tries them via IMAP against your tenant, and gets in. Your MFA policy does nothing. This is one of the most common techniques in Microsoft 365 account takeovers.

How to check if legacy authentication is enabled

The easiest way: go to Entra ID → Sign-in logs and filter by "Client app." If you see entries for Exchange ActiveSync, IMAP, POP3, or Other clients — legacy auth is in use in your tenant.

M365Clarity checks this automatically and flags it as red if legacy authentication isn't blocked.

How to block it

Option 1: Conditional Access (recommended — Business Premium, E3, E5)

Create a Conditional Access policy:

Entra ID → Security → Conditional Access → New policy
Name: "Block legacy authentication"
Users: All users
Cloud apps: All cloud apps
Conditions → Client apps: tick Exchange ActiveSync clients, Other clients
Grant: Block access
Enable policy: On

Option 2: Security Defaults (Business Basic / Standard)

Security Defaults automatically blocks legacy authentication for all users. Enable it in Entra ID → Properties → Manage Security Defaults. Note: this also enforces MFA for everyone, which is the right call.

Before you block: check for dependencies

Before enabling the block, audit your environment for anything still using legacy auth:

Printers or multifunction devices using SMTP to send scans by email
Line-of-business applications authenticating to Exchange
Users on very old versions of Outlook (2010 or earlier)
Shared mailboxes accessed via IMAP by monitoring tools

Use the Sign-in logs filter above to identify these before blocking. Anything using legacy auth needs to be migrated to modern auth or OAuth before you flip the switch.

Check your Microsoft 365 configuration in 2 minutes

Connect your tenant, run a scan, and see exactly what needs attention — in plain English. Free plan available.

Scan your tenant free →