Legacy authentication protocols cannot do multifactor authentication, so attackers use them to get around it. To block them safely in Entra, find who still uses them in the sign in logs, create a Conditional Access policy in report only mode, fix or exclude what breaks, then switch the policy to On.
Why bother
Microsoft's analysis, which it states in its documentation, is that more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication. Blocking or disabling basic authentication would stop those attacks. These are Microsoft's figures, not ours, but the direction is clear: MFA means little if an older door stays open.
If you have no license that includes Conditional Access, security defaults can block legacy authentication for you.
Step 1: find the usage
In the Entra admin center, open Sign-in logs under Monitoring and health. Add the Client App column, filter on the legacy protocol values, and apply. Do the same on the non interactive sign in tab. Selecting an entry shows which protocol was used. Microsoft also offers a workbook for sign ins using legacy authentication to help triage.
Typical culprits are old mail clients, scanners and printers sending mail, and scripts using IMAP, POP3 or SMTP basic authentication.
Step 2: create the policy in report only
Create a new Conditional Access policy:
- Users: include all users. Exclude your emergency access accounts and any service account that must keep working while you migrate it.
- Target resources: all resources.
- Conditions, client apps: select only Exchange ActiveSync clients and Other clients.
- Grant: block access.
- Enable policy: report only.
Report only lets you see what the policy would have blocked without blocking it.
Step 3: handle the exclusions properly
Microsoft recommends excluding at least one emergency access account to avoid a lockout from misconfiguration. Service accounts and service principals need thought. Calls made by service principals are not blocked by policies scoped to users, and if scripts use such accounts, Microsoft suggests replacing them with managed identities.
For devices and apps that send mail, follow Microsoft's guidance on setting up a multifunction device or application to send email through Microsoft 365 with a supported method.
Step 4: switch it on
When the report only results show the policy hits only what you expect, move the toggle to On. You can also stage it by group, adding some groups first and excluding others.
Step 5: keep watching
Re-run the sign in log filter monthly for a while. An exception that nobody owns tends to live forever. Put an end date and an owner on each one.
A note on scope: Conditional Access is enforced after first factor authentication. It is not meant to be a first line of defense against denial of service.
Quick check
Which client app boxes do I tick in the policy?
Only Exchange ActiveSync clients and Other clients.
Why start in report only mode?
It shows the impact on existing users before the block is enforced.
Sources
- Block legacy authentication with Conditional Access
- Configure security defaults for Microsoft Entra ID
Last reviewed: 19 October 2026.
