Legacy authentication is the old way apps signed in: send a username and password with every request, no MFA, no device check. Microsoft has spent years switching it off in Exchange Online, so many owners assume the job is done. It usually is not. If you want to block legacy authentication for good, you need to confirm it is gone everywhere, not just in the places Microsoft already closed.
In the tenants I review, legacy sign-in attempts still show up in the logs almost every time. Most fail. The ones that succeed are the reason this article exists.
Why legacy authentication is still a problem
Legacy, or basic, authentication cannot do MFA. That means a stolen or guessed password is all an attacker needs. It is the favourite route for password spray attacks, where an attacker tries a few common passwords against every account in your tenant.
Microsoft has removed basic authentication in Exchange Online for Exchange ActiveSync, POP, IMAP, Exchange Web Services, Remote PowerShell, Offline Address Book, Autodiscover and Outlook for Windows and Mac. It cannot be re-enabled. So where does the risk come from now?
SMTP AUTH client submission. Microsoft has announced the retirement of basic authentication for SMTP AUTH and has updated the timeline more than once, so check the latest Exchange team announcement for current dates. Until it is gone in your tenant, any mailbox with SMTP AUTH enabled can accept a password-only sign-in.
Old devices and apps. Scanners, line-of-business apps and third-party mail tools that were configured years ago and quietly keep trying.
Hybrid Exchange. On-premises Exchange servers in a hybrid setup have their own authentication settings and are not covered by the Exchange Online change.
Attackers probing anyway. Even when sign-ins fail, legacy protocols are still used to test whether a password is valid.
Step 1: find out who is still using it
Before you block anything, look at the logs. This tells you what will break and who to talk to.
Sign in to the Microsoft Entra admin center as at least a Reports Reader.
Go to Entra ID > Monitoring & health > Sign-in logs.
Add the Client app column if it is not shown.
Select Add filters > Client app, choose all the legacy authentication protocols, and apply.
Repeat on the User sign-ins (non-interactive) tab, where a lot of device and app traffic appears.
For a longer view, open the Sign-ins using legacy authentication workbook, which can show up to 90 days if your logs are sent to Log Analytics.
Sort the results into three groups: successful sign-ins from things you recognize (fix these), successful sign-ins from things you do not (investigate these as possible compromises), and failures from unknown IPs (attack traffic, which the block will make pointless).
Write the first two groups down with an owner for each. That list becomes your exclusion plan and your fix list in the steps below.
Step 2: block it with Conditional Access
Conditional Access needs Entra ID P1, which is included in Microsoft 365 Business Premium. If you do not have P1, security defaults also block legacy authentication, along with requiring MFA registration for everyone.
In the Entra admin center, go to Entra ID > Conditional Access > Policies and select New policy.
Name it clearly, for example CA02-AllUsers-BlockLegacyAuth.
Under Users, include All users. Exclude your emergency access accounts, plus any account you have confirmed must still use legacy authentication for now.
Under Target resources, include All resources.
Under Conditions > Client apps, set Configure to Yes and tick only Exchange ActiveSync clients and Other clients.
Under Grant, select Block access.
Set the policy to Report-only and leave it for a week. Review what it would have blocked.
When the results match what you expect, switch it to On.
Microsoft publishes this exact policy as a template, so you can also create it from Conditional Access > Create new policy from templates.
Step 3: close the doors Conditional Access cannot
There is a catch most guides skip. Conditional Access is evaluated after the first factor, the password, has been checked. A blocked legacy sign-in still tells an attacker whether the password was right, and repeated attempts can still lock accounts. To shut the door at the service itself:
Disable SMTP AUTH at the organization level with Set-TransportConfig -SmtpClientAuthenticationDisabled $true, then enable it only on the specific mailboxes that still need it with Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. Microsoft already disables SMTP AUTH for tenants created after January 2020.
Turn off POP and IMAP per mailbox where nobody uses them: Set-CASMailbox -Identity user@yourdomain.com -PopEnabled $false -ImapEnabled $false. Use CAS mailbox plans with Set-CASMailboxPlan to make that the default for new mailboxes, so you do not have to remember it for every new starter.
Use Exchange authentication policies if you run hybrid Exchange, to block basic authentication on the on-premises side too.
Remove app passwords. If you still use legacy per-user MFA, disable app passwords. They depend on basic authentication and bypass MFA by design.
Step 4: fix the things that break
Blocking legacy authentication rarely breaks much in 2026, but when it does, it is usually one of these.
What breaks
Modern replacement
Scanner or copier sending email
SMTP relay through an Exchange Online connector, direct send for internal-only mail, or High Volume Email for internal recipients
Application sending notifications
Microsoft Graph sendMail with an app registration, or Azure Communication Services Email
Old Outlook or mail client
Current Outlook for Windows, Mac, iOS or Android, which use modern authentication
Native phone mail app using Exchange ActiveSync with basic auth
Outlook mobile, or a native app configured for modern authentication
Script using stored credentials
Certificate-based app authentication or a managed identity
Treat every exclusion in your block policy as temporary. Give it an owner and a review date. In my experience, exclusions that have no end date are still there three years later.
Hasn’t Microsoft already turned off legacy authentication?
For most Exchange Online protocols, yes, permanently. Basic authentication for SMTP AUTH is on a separate retirement timeline, hybrid Exchange is not covered, and attackers still attempt legacy sign-ins. A Conditional Access block plus service-level settings makes sure nothing slips through.
Do I need Entra ID P1 to block legacy authentication?
A Conditional Access policy needs Entra ID P1, included in Business Premium. Without P1, security defaults block legacy authentication for the whole tenant, though with less flexibility for exceptions.
Will blocking legacy authentication stop password spray attacks?
It removes the most useful target, because legacy protocols cannot enforce MFA. Conditional Access still checks the password before blocking, so also disable SMTP AUTH, POP and IMAP where unused, and require MFA for every account.
Want to know whether legacy authentication is still open in your tenant? Book a free Microsoft 365 security assessment and we will check your sign-in logs and close the gaps.
Legacy authentication is the old way apps signed in: send a username and password with every request, no MFA, no device check. Microsoft has spent years switching it off in Exchange Online, so many owners assume the job is done. It usually is not. If you want to block legacy authentication for good, you need to confirm it is gone everywhere, not just in the places Microsoft already closed.
In the tenants I review, legacy sign-in attempts still show up in the logs almost every time. Most fail. The ones that succeed are the reason this article exists.
Why legacy authentication is still a problem
Legacy, or basic, authentication cannot do MFA. That means a stolen or guessed password is all an attacker needs. It is the favourite route for password spray attacks, where an attacker tries a few common passwords against every account in your tenant.
Microsoft has removed basic authentication in Exchange Online for Exchange ActiveSync, POP, IMAP, Exchange Web Services, Remote PowerShell, Offline Address Book, Autodiscover and Outlook for Windows and Mac. It cannot be re-enabled. So where does the risk come from now?
Step 1: find out who is still using it
Before you block anything, look at the logs. This tells you what will break and who to talk to.
Entra ID > Monitoring & health > Sign-in logs.Sort the results into three groups: successful sign-ins from things you recognize (fix these), successful sign-ins from things you do not (investigate these as possible compromises), and failures from unknown IPs (attack traffic, which the block will make pointless).
Write the first two groups down with an owner for each. That list becomes your exclusion plan and your fix list in the steps below.
Step 2: block it with Conditional Access
Conditional Access needs Entra ID P1, which is included in Microsoft 365 Business Premium. If you do not have P1, security defaults also block legacy authentication, along with requiring MFA registration for everyone.
Entra ID > Conditional Access > Policiesand select New policy.CA02-AllUsers-BlockLegacyAuth.Microsoft publishes this exact policy as a template, so you can also create it from
Conditional Access > Create new policy from templates.Step 3: close the doors Conditional Access cannot
There is a catch most guides skip. Conditional Access is evaluated after the first factor, the password, has been checked. A blocked legacy sign-in still tells an attacker whether the password was right, and repeated attempts can still lock accounts. To shut the door at the service itself:
Set-TransportConfig -SmtpClientAuthenticationDisabled $true, then enable it only on the specific mailboxes that still need it withSet-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. Microsoft already disables SMTP AUTH for tenants created after January 2020.Set-CASMailbox -Identity user@yourdomain.com -PopEnabled $false -ImapEnabled $false. Use CAS mailbox plans withSet-CASMailboxPlanto make that the default for new mailboxes, so you do not have to remember it for every new starter.Step 4: fix the things that break
Blocking legacy authentication rarely breaks much in 2026, but when it does, it is usually one of these.
Treat every exclusion in your block policy as temporary. Give it an owner and a review date. In my experience, exclusions that have no end date are still there three years later.
Microsoft’s full walkthrough is in Block legacy authentication with Conditional Access. If you want help, our MFA enablement service includes the legacy authentication block, the tenant checker gives you a quick external view, and our NIST CSF assessment maps identity gaps like this one to a wider framework.
Frequently asked questions
Hasn’t Microsoft already turned off legacy authentication?
For most Exchange Online protocols, yes, permanently. Basic authentication for SMTP AUTH is on a separate retirement timeline, hybrid Exchange is not covered, and attackers still attempt legacy sign-ins. A Conditional Access block plus service-level settings makes sure nothing slips through.
Do I need Entra ID P1 to block legacy authentication?
A Conditional Access policy needs Entra ID P1, included in Business Premium. Without P1, security defaults block legacy authentication for the whole tenant, though with less flexibility for exceptions.
Will blocking legacy authentication stop password spray attacks?
It removes the most useful target, because legacy protocols cannot enforce MFA. Conditional Access still checks the password before blocking, so also disable SMTP AUTH, POP and IMAP where unused, and require MFA for every account.
Want to know whether legacy authentication is still open in your tenant? Book a free Microsoft 365 security assessment and we will check your sign-in logs and close the gaps.