Blocking Legacy Authentication in Microsoft 365

Legacy authentication protocols (Basic Auth, IMAP, POP3, SMTP AUTH, older ActiveSync) bypass modern authentication and cannot enforce MFA — making them a primary attack vector. Microsoft disabled Basic Auth for most protocols in 2022, but verifying your environment is fully blocking legacy auth is still important. To check for legacy auth usage, go to Azure AD > Sign-in logs and filter by "Client app" for entries like "Other clients," "IMAP," "POP3," or "MAPI over HTTP." Identify any users or applications still relying on these protocols before blocking them. To block legacy auth via Conditional Access: go to Azure AD > Security > Conditional Access > New policy. Target All users, set the condition Client apps to Legacy authentication clients, and set the Access control to Block access. Enable the policy in report-only mode first to monitor impact before enforcing it.