Block Legacy Authentication with Conditional Access

Why this lab matters

Legacy authentication means older protocols that send a username and password and nothing else: POP3, IMAP4, SMTP AUTH, Exchange ActiveSync with basic authentication and older Office clients. They cannot show an MFA prompt. If a password is guessed or leaked, a legacy protocol lets the attacker straight in, even when the same user is asked for MFA in a browser.

The fix is a single Conditional Access policy. The risk is blocking a printer, a scanner or a line of business app that nobody remembered. So you measure first, block second.

Step 1: Measure legacy sign-ins

Use the sign-in logs

1. Open the Microsoft Entra admin centre and go to Identity, Monitoring and health, Sign-in logs.
2. Set the date range to the last 7 days, or 30 days if you have the retention.
3. Add the filter Client app and tick every entry under Legacy Authentication Clients.
4. Check both the interactive and non-interactive tabs. Download the results as CSV.

Or query with Graph PowerShell

Connect-MgGraph -Scopes "AuditLog.Read.All"

$since = (Get-Date).AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
$modern = "Browser", "Mobile Apps and Desktop clients"

Get-MgAuditLogSignIn -All -Filter "createdDateTime ge $since" |
  Where-Object { $_.ClientAppUsed -and $_.ClientAppUsed -notin $modern } |
  Group-Object UserPrincipalName, ClientAppUsed |
  Sort-Object Count -Descending |
  Select-Object Count, Name

Each row is a user and protocol pair. A count of zero across the tenant means you can move quickly. Any rows that remain need an owner.

Step 2: Find an owner for each result

What you see	Likely cause	Usual fix
SMTP from one account, steady volume	Scanner, printer or application sending mail	Move to OAuth, or a mail relay service built for devices
IMAP or POP from a few users	Old mail client or a mobile mail app	Move the user to Outlook or a modern client
Failed attempts from many countries	Password spray	No fix needed. The block stops it
Exchange ActiveSync	Old phone mail profile	Recreate the profile with modern authentication

Step 3: Create the policy in report-only mode

1. Go to Protection, Conditional Access, Policies, New policy.
2. Name it CA-BLOCK-LegacyAuth.
3. Users: include All users. Exclude your emergency access accounts.
4. Target resources: All resources.
5. Conditions, Client apps: set Configure to Yes and tick only Exchange ActiveSync clients and Other clients.
6. Grant: Block access.
7. Set Enable policy to Report-only and create it.

Step 4: Review the impact

Open any legacy sign-in in the sign-in logs and select the Report-only tab. A result of Report-only: Failure means the sign-in would have been blocked. Work through the list from Step 2 until every remaining failure is either fixed or is an attack you are happy to block.

Step 5: Enforce and verify

1. Edit the policy and change Enable policy to On.
2. From a test account, try an IMAP or POP connection with a mail client set to basic authentication. It should fail.
3. Find that attempt in the sign-in logs. The Conditional Access tab should show CA-BLOCK-LegacyAuth with the result Failure, and the sign-in status should be Failure with error code 53003.

Evidence to keep

• The CSV of legacy sign-ins before the change.
• A screenshot of the policy settings, including the excluded accounts.
• The blocked test sign-in showing the policy name.
• A short list of any devices or apps you migrated, with the owner of each.

Clean up

In a test tenant, set the policy back to Off or delete it when you are done. In a real tenant this policy stays on permanently.