← All guides
5 min read
How to block legacy authentication in Entra ID without breaking scanners
Audit sign-in logs for IMAP, POP3, and SMTP Basic Auth, migrate multifunction printers to High Volume Email or OAuth, and block legacy protocols.
Why legacy authentication is the #1 initial access vector
Legacy protocols such as POP3, IMAP4, and Exchange ActiveSync Basic Auth cannot display interactive MFA prompts. Attackers use residential proxies to spray common passwords against legacy endpoints while completely ignoring your MFA rules.
Find every account still using basic authentication
In Entra ID Sign-in logs, filter by Client App → Legacy Authentication Clients over the past 30 days. Most hits are either malicious spray attempts or an office scanner sending PDFs.
Entra IDConditional Access → Block Legacy Authentication
Users: All users (exclude break-glass) | Client apps: Exchange ActiveSync clients + Other clients | Grant: Block access
Free tool
Browse the Microsoft 365 checks and their CIS mappings →No sign-up required. Free Pistos Pharos utility.