How to block legacy authentication in Microsoft 365

Legacy authentication means the older sign-in protocols that cannot perform multi-factor authentication: POP, IMAP, SMTP AUTH, older Exchange ActiveSync clients, and anything using Basic auth. They matter because they bypass MFA completely. An attacker who has a valid password and finds one of these protocols open does not get prompted for a second factor — which is why password-spray attacks target them specifically.

Microsoft has already disabled Basic auth for most Exchange Online protocols, which helps. But that change does not cover everything, and nothing at the identity layer blocks the rest unless you configure it.

Find what is still using it first

Blocking before you look is how you discover on Monday that the warehouse scanner has not sent a delivery note since Friday. If you have Entra ID P1:

1. Entra admin center → Identity → Monitoring & health → Sign-in logs.
2. Add filters → Client app, and select everything under Legacy Authentication Clients.
3. Set the date range to the last month and review what appears.

Expect to find: multifunction printers and scanners sending via SMTP AUTH, backup or monitoring tools, an old CRM or line-of-business app, and occasionally a long-serving user with a mail client nobody has updated since 2014.

Without P1 you do not get this filter. In that case check the Exchange admin center for mailboxes with POP or IMAP enabled, and ask around about devices that send email — the printer is almost always the answer.

Block it with security defaults (any licence)

Security defaults block legacy authentication as part of what they do, at no cost on any plan.

1. Entra admin center → Identity → Overview → Properties.
2. Manage security defaults → Enabled → Save.

This also enforces MFA for everyone, which is usually what you want but is a bigger change than blocking legacy auth alone. There is no way to exclude a single device, so anything still using these protocols has to be migrated first.

Block it with Conditional Access (Entra ID P1)

With P1 you can block legacy authentication without changing anything else:

1. Entra admin center → Protection → Conditional Access → New policy.
2. Users: All users, excluding your break-glass account.
3. Target resources: All resources.
4. Conditions → Client apps → set to Yes, then tick only Exchange ActiveSync clients and Other clients.
5. Grant: Block access.
6. Start in Report-only for a week, review the workbook under Conditional Access → Insights and reporting, then switch to On.

Report-only genuinely is the right move here — a week of data tells you exactly what will break, with no outage. Just make sure you come back and turn it on. A report-only policy enforces nothing.

Fixing the printer before you break it

For a device that only needs to send mail, you have three options, best first:

• Direct send — the device sends to your tenant's MX endpoint with no authentication, for internal recipients only. No licence, no credentials, nothing to leak.
• SMTP relay via a connector — an Exchange Online connector that accepts mail from your public IP address. Works for external recipients. Requires a static IP.
• SMTP AUTH on a dedicated mailbox — last resort. If you must, use a mailbox created solely for the device, and enable SMTP AUTH on that one mailbox rather than tenant-wide: Exchange admin center → Mailboxes → select → Manage email apps → Authenticated SMTP.

Tenant-wide SMTP AUTH is off by default on newer tenants. Leave it off, and enable it per mailbox only where a device genuinely needs it.

Questions

Click paths verified October 2026. Microsoft renames things in the admin centers regularly; the underlying settings are stable even when the menus move.