How to block legacy authentication with Conditional Access

Blocking legacy authentication with Conditional Access is one policy: all users, all cloud apps, client apps set to Exchange ActiveSync clients and Other clients, grant control Block access. The work is not in building it; it is in running it report-only long enough to find the scanner in the finance office that still sends invoices over SMTP AUTH, and fixing that first.

Legacy authentication — Basic auth over POP, IMAP, SMTP AUTH, EWS, ActiveSync, older Office clients — cannot enforce MFA, which is why the overwhelming majority of password-spray compromises historically came through it. Even with Microsoft's own deprecations, this policy belongs in every Conditional Access baseline as the backstop.

Prerequisites

Entra ID P1 (included in Business Premium, E3, E5, F1, F3) for Conditional Access. Security defaults must be off; the two are mutually exclusive.
Conditional Access Administrator or Security Administrator role.
At least one break-glass account excluded from this and every other policy.
Two to four weeks of sign-in log data to find current legacy usage. If the tenant has no Log Analytics workspace, the portal's 30-day retention (P1/P2) is enough.

Steps

Progress 0/5

Progress is saved in this browser only.

1. Find who still uses legacy authentication

Entra admin center → Monitoring → Sign-in logs, add the Client app filter and select every option except Browser and Mobile Apps and Desktop clients. Include the user sign-ins (non-interactive) and service principal tabs — background mail clients live there. Group by user and application; the list is usually short: a couple of multifunction printers, a legacy line-of-business app, an old iPhone Mail profile, a monitoring tool.

The Insights and reporting workbook Sign-ins using legacy authentication does the same thing with a chart, if Log Analytics is connected.

2. Fix or isolate each remaining consumer

Move devices to OAuth-capable firmware or to an Exchange Online connector-based relay that authenticates by certificate or source IP, so no user credential is involved. Old mail profiles just need re-adding with modern authentication. Anything that genuinely cannot change gets a dedicated service account that you will exclude in step 4 — accept that as debt, not a solution.

3. Create the policy

Entra admin center → Protection → Conditional Access → Policies → New policy:

Name: CA-BLOCK-LegacyAuth-AllUsers (or whatever naming scheme your baseline uses).
Users: All users. Exclude: break-glass accounts, and — temporarily — the service accounts from step 2.
Target resources: All cloud apps.
Conditions → Client apps: Configure Yes; tick Exchange ActiveSync clients and Other clients only. Leave Browser and Mobile apps and desktop clients unticked — those are modern auth.
Grant: Block access.
Enable policy: Report-only.

4. Run report-only

Leave it in report-only for at least a week (a month if you have monthly batch jobs). Sign-in logs → the sign-in → Report-only tab shows what the policy would have done per sign-in; the Conditional Access Insights and reporting workbook aggregates it. Every Failure (report-only) hit is either something you fixed in step 2 and missed, or something new. The Conditional Access testing guide covers reading these results without jumping to conclusions.

5. Enforce

Switch Enable policy to On. Do it on a weekday morning, not Friday afternoon.

Verify

Sign-in logs filtered by Client app: Other clients and Exchange ActiveSync show only failures with Conditional Access as the failure reason.
Test with an IMAP client or Test-NetConnection plus a basic-auth login against outlook.office365.com on port 993 using a test account — it should fail at authentication.
No new helpdesk tickets about mail on old devices in the first 48 hours; if there are, the users are on profiles that were not seen in the log window (a device that was switched off).

Roll back

Set the policy to Report-only (not delete — you lose the configuration and the report data). Conditional Access changes apply to new sign-ins within minutes. Add the affected account to the exclusion list while you fix the underlying client, and set a date to remove the exclusion; the exclusion list on this policy should trend to zero.

Frequently asked questions

Isn't legacy authentication already disabled in Microsoft 365?

Mostly. Microsoft turned off Basic authentication for Exchange Online protocols (EWS, POP, IMAP, ActiveSync, Remote PowerShell) for all tenants during 2022–2023, and SMTP AUTH is disabled by default in new tenants. But SMTP AUTH can still be enabled per mailbox, and legacy protocols against other workloads are not covered by that change. The Conditional Access block is the tenant-wide backstop that does not depend on per-service defaults.

Will blocking legacy authentication break printers and scanners that send email?

Only if they use SMTP AUTH with a username and password against Exchange Online — and the sign-in logs will show them before you enforce. The fixes are, in order of preference: Microsoft Graph or OAuth-capable firmware, an SMTP relay connector using certificate or IP authentication (no user sign-in), or a dedicated mailbox with SMTP AUTH enabled and the policy scoped to exclude it. The last option is the one to avoid if you can.

Do security defaults block legacy authentication?

Yes. Security defaults block legacy authentication protocols for all users. If your tenant is on security defaults you already have this control, but you cannot combine security defaults with Conditional Access policies — moving to Conditional Access means rebuilding the block as a policy, which is what this guide does.