---
title: Why You Need To Block Microsoft Legacy Authentication
description: Your systems are at risk of being compromised if you use Microsoft legacy authentication. Learn how to protect your business from cyber threats.
image: https://blog.integrityts.com/hubfs/block-microsoft-legacy-authentication.jpg
---
[](https://www.integrityts.com/)
- [Who We Are](https://www.integrityts.com/who-we-are/)
- [Our Team](https://www.integrityts.com/who-we-are/our-team/)
- [Partners & Certifications](https://www.integrityts.com/who-we-are/partners-certifications/)
- [NIST Cybersecurity Framework](https://www.integrityts.com/who-we-are/nist-cybersecurity-framework/)
- [Careers](https://www.integrityts.com/careers/)
- [Industries](https://www.integrityts.com/industries/)
- [Financial Institutions](https://www.integrityts.com/industries/financial-institutions/)
- [Healthcare](https://www.integrityts.com/industries/healthcare/)
- [Insurance](https://www.integrityts.com/industries/insurance/)
- [Manufacturing](https://www.integrityts.com/industries/manufacturing/)
- [Services](https://www.integrityts.com/services/)
- [Co-Managed IT Support](https://www.integrityts.com/services/co-managed-it-support/)
- [IT Cybersecurity](https://www.integrityts.com/services/it-cybersecurity/)
- [IT Support](https://www.integrityts.com/services/it-support/)
- [Technology Advisement](https://www.integrityts.com/services/it-support/technology-advisement/)
- [Managed Security](https://www.integrityts.com/services/it-support/managed-security/)
- [RemoteFix Help Desk](https://www.integrityts.com/services/it-support/remotefix-help-desk/)
- [Security Awareness Program](https://www.integrityts.com/services/it-support/security-awareness-program/)
- [Managed Cloud Security](https://www.integrityts.com/services/it-support/managed-cloud-security/)
- [Vulnerability Management](https://www.integrityts.com/services/it-support/vulnerability-management/)
- [Managed Detection & Response](https://www.integrityts.com/services/it-support/managed-detection-response/)
- [Managed Backup & Disaster Recovery](https://www.integrityts.com/services/it-support/managed-backup-disaster-recovery/)
- [Teams Phones (Voice)](https://www.integrityts.com/services/it-support/teams-phones-voice/)
- [IT Tool Kit](https://www.integrityts.com/services/it-support/it-tool-kit/)
- [Password Management / LAPS – Copy](https://www.integrityts.com/services/it-support/password-management-laps/)
- [Secure Cloud / Hosted Infrastructure](https://www.integrityts.com/services/it-support/secure-cloud-hosted-infrastructure/)
- [Microsoft 365 Licensing/New Commerce Experience](https://www.integrityts.com/services/it-support/microsoft-365-licensing-new-commerce-experience/)
- [IT Professional Services & Consulting](https://www.integrityts.com/services/it-professional-services-consulting/)
- [Network Infrastructure](https://www.integrityts.com/services/it-professional-services-consulting/network-infrastructure/)
- [Cloud Migrations](https://www.integrityts.com/services/it-professional-services-consulting/cloud-migrations/)
- [Incident Response](https://www.integrityts.com/services/it-professional-services-consulting/incident-response/)
- [SharePoint Consulting](https://www.integrityts.com/services/it-professional-services-consulting/sharepoint-consulting/)
- [Security Risk Assessments](https://www.integrityts.com/services/it-professional-services-consulting/security-risk-assessments/)
- [Tabletop Exercises](https://www.integrityts.com/services/it-professional-services-consulting/tabletop-exercises/)
- [AI Capabilities](https://www.integrityts.com/services/it-professional-services-consulting/ai-capabilities/)
- [Administrative Policies & Controls](https://www.integrityts.com/services/it-professional-services-consulting/administrative-policies-controls/)
- [HIPAA Risk Assessments](https://www.integrityts.com/services/it-professional-services-consulting/hipaa-risk-assessments/)
- [MIPS Consulting](https://www.integrityts.com/services/it-professional-services-consulting/mips-consulting/)
- [SAFER Guides Consulting](https://www.integrityts.com/services/it-professional-services-consulting/safer-guides-consulting/)
- [Pricing](https://www.integrityts.com/pricing/)
- [Blog](https://blog.integrityts.com/)
- [Contact](https://www.integrityts.com/contact/)
# Blog
## Why You Need To Block Microsoft Legacy Authentication
[Integrity Staff](https://blog.integrityts.com/author/integrity-staff)
March 03, 2025 at 10:00 AM
Why You Need To Block Microsoft Legacy Authentication
8:40
If your business is using Microsoft legacy authentication, your systems may be at risk of being compromised.
Why?
Legacy authentication protocols such as POP, MAPI, SMTP, and IMAP can't enforce [multifactor authentication](https://blog.integrityts.com/protect-your-business-with-multifactor-authentication), making them targeted entry points for attacks and adversaries.
But, there's more.
In this article, we explain what legacy authentication is, why it's important to block legacy authentication, and how to protect your business from cyber threats.
## **What Is Microsoft Legacy Authentication?**
Microsoft Legacy authentication refers to the built-in authentication strengths that allow users to sign in to an email or other Microsoft applications and cloud services.
It’s an authentication request made by either:
- Older Office clients that don't have modern authentication (such as Office 2010)
- Microsoft apps or clients that support legacy mail protocols, such as SMTP/IMAP/POP3
Legacy authentication protocols aren't a single protocol, but refer to anything that doesn't support or allow [multi-factor authentication](https://blog.integrityts.com/multifactor-authentication) (MFA), or two-factor authentication (2FA).
This leaves apps and clients vulnerable to attacks and unauthorized access trials.
Many compromising sign-in attempts are generated from legacy authentication clients because of their weak security.
## **Modern Authentication vs. Legacy Authentication**
Protocols that support and allow modern MFA methods, such as ADAL and OAuth, used in Azure AD and [Microsoft 365](https://blog.integrityts.com/microsoft-365-plans-for-business).
Modern authentication is a user identity management method that offers safer and more secure user authorization and authentication than legacy authorization.
It allows users to authenticate their login with a web dialog of the ID provider (Azure AD) instead of the app (Outlook, Thunderbird) or OS (Windows).
This means the ID provider doesn't trust the apps and services to handle user credentials.
Only the ID provider, Azure AD, is trusted to deal with the credentials and is allowed to issue tokens.
With legacy authentication, you’re not protected, even if you use [endpoint detection and response.](https://blog.integrityts.com/endpoint-detection-response-legacy-antivirus)
Let's see the comparison of modern authentication compared to legacy authentication:
| **Legacy (basic) Authentication** | **Modern Authentication** |
| --- | --- |
| A network or client protocol can't support modern authentication because it's either incapable or has no configuration. | A service or client that allows MFA/2FA and can use SAML, OpenID Connect, and/or OAuth 2.0 authentication. |
| A client interacts with the application and not the user. This means it sends both the username and password to the email or application instead of the user. | A service or client that accepts redirects to an identity provider for authentication interactions and supports authentication tokens of the above protocols. |
| The application, and not the user, uses the login and password information to get a login token. | |
## **Why Do I Need To Block Legacy Authentication?**
Legacy authentication methods are vulnerable to account breaches and expose security weaknesses that allow hackers backdoor access to an organization's data.
Unlike modern authentication, legacy authentication neither understands nor supports MFA.
These are the simplest modern protection strategies against account breaches, and any security program that lacks them is weak and vulnerable.
This makes legacy authentication susceptible to automated breaches and attacks such as keylogging, brute force, and password spray.
- According to [Microsoft](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication), legacy authentication security stats have worrying trends. For example, over 99% of password spray and over 97% of credential stuffing attacks arise from legacy authentication protocols.
- Azure AD accounts that disabled legacy authentication encounter 67% fewer compromises or attacks than those with legacy authentication enabled.
Furthermore, even if you've enabled an MFA policy on your directory, a legacy protocol can still allow bad actors to authenticate and bypass MFA.
The only sure way to protect your account from attackers and malicious authentication is to block legacy protocols.
Microsoft began deprecating legacy authentication for all Microsoft 365 clients on [October 1, 2022](https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online).
## **How Do I Block Microsoft Legacy Authentication?**
You can use several methods to block legacy authentication in Microsoft 365 and other apps.
If your security defaults are enabled in Office 365 or client (either manually or you have a tenant created after October 2019), then legacy auth is already blocked at the tenant level.
You can also block legacy authentication directly in the admin center of your Azure Directory, Microsoft 365, or Exchange Online.
## **How Do I Block Legacy Authentication With Conditional Access Policy?**
Use the following steps to block legacy (basic) authentication and grant controls with the conditional access policy.
### **Step 1: Check that you have an Azure AD Premium P1 license **
You can only block legacy authentication through conditional access (CA) if you have Microsoft licensing that gives you Azure AD Premium P1 or P2.
To check the license:
1. Sign in to your Microsoft Azure portal.
2. Navigate to Azure Active Directory.
3. Go to Overview.
4. Check whether you have Azure AD Premium P1 or P2 license.
Once you confirm this, you can proceed and initiate a new policy.
### **Step 2: New Conditional Access Policy**
Through the Azure AD premium license P1 or P2, you can create a conditional access policy.
This will force block legacy authentication for all users in your directory.
You can also select only a group of users to block.
But, it's recommended to disable legacy authentication for all the users and apps in your directory.
To do this:
1. Navigate to Azure AD portal > then Azure Active Directory Home
2. Browse to Security
3. Go to Conditional Access > Policies
4. Click New policy.
Clicking on the new policy will require you to give your policy a name.
### **Step 3: Name and Assignments **
Under "New conditional access policy," you'll need to name it and give it assignments.
1. Under Name, give it a name that shows the policy's goal, such as **\[BLOCK\] Legacy authentication**.
2. Under assignments: Click on Users and groups > then choose Include > then select All users.
You also can select users and groups such as guests and external users, directory roles, or users and groups.
Make a choice depending on what you want on the policy.
### **Step 4. Specify Cloud apps or actions**
On the Cloud apps or actions section, you'll specify the clients that will use the conditional access policy.
1. Click the Cloud apps option
2. Choose Include under cloud apps.
3. Select All cloud apps.
You can also select apps if you want to specify only the apps that use conditional access.
### **Step 5. Set Conditions**
Once you select the apps, you'll need to set conditions of use.
1. Click Conditions > then select Client apps.
2. Under client apps, click on Yes (or toggle to Yes).
3. Under legacy authentication clients, select both Mobile clients and desktop clients > Exchange ActiveSync clients and Other clients.
4. Then click Done.
### **Step 6. Grant and Enable Policy**
Once you've specified the policy's clients:
1. Click on Grant.
2. Under control user access enforcement to block or grant access, select Block access.
3. Below it, to the bottom, click on Select.
4. Now, below Grant, click the On switch (or Report Only). This will enable the policy.
5. Finally, choose "**I understand that my account will be impacted by this policy. Proceed anyway.**"
6. Then click Create.
Voila!
You've blocked legacy authentication with the conditional access policy.
This policy will show up in your conditional access policies list—it can take up to 24 hours to take effect.
**Remember:** If your directory has enabled security defaults, legacy authentication is already disabled in your Exchange Online. You'll need to block legacy authentication through PowerShell manually.
## **Conclusion**
We hope you've learned why you should and how to disable legacy authentication and do it with conditional access.
This will help you secure your organization and data from attacks.
Always take steps to secure your organization from attacks and malicious authentication requests.
Finally, if you're not sure of your organization's current security position, download this free [**data security checklist**](https://content.integrityts.com/data-security-checklist) to see your strengths and where you may need help.
[](https://cta-redirect.hubspot.com/cta/redirect/2136188/419d6876-083c-4c40-a40e-f4178b21ff17)
Then, [reach out to Integrity Technology Solutions](https://www.integrityts.com/#contact) to see how we can help you.
[Microsoft 365](https://blog.integrityts.com/topic/microsoft-365), [IT Professional Services & Consulting](https://blog.integrityts.com/topic/it-professional-services-consulting), [Administrative Policies & Controls](https://blog.integrityts.com/topic/administrative-policies-controls)
### Leave a Reply
## Read On
### [How To Build A Business Case For Manufacturing IT Projects Without Overcomplicating It](https://blog.integrityts.com/manufacturing-it-business-case/)
Manufacturing IT projects are easier to justify when you stop treating them like technology...
### [Manufacturing Cybersecurity Without The Jargon: A Plain-English Guide For Operations Leaders](https://blog.integrityts.com/manufacturing-cybersecurity-plain-english/)
Manufacturers don’t need a cybersecurity program built around buzzwords. They need technology that...
### [What Bank Cybersecurity Auditors Are Really Looking For](https://blog.integrityts.com/what-bank-cybersecurity-auditors-are-really-looking-for)
Cybersecurity auditors are looking for more than technical problems or opportunities to issue...
## CONTACT US
### PROTECT YOUR BUSINESS.
Integrity helps businesses dealing with sensitive data protect against looming cybersecurity threats.
### Address:
816 South Eldorado Road, Suite #4
Bloomington, IL 61704
### Call Us:
[+1 309.662.7723](tel:13096627723)
### Email:
[info@integrityts.com](mailto:info@integrityts.com)
[](https://x.com/integrityts)
#### Customers: Need Assistance Now?
### Call Customer Support:
[+1 888.764.8181](tel:18887648181)
### Email Customer Support:
[remotefix@integrityts.com](mailto:remotefix@integrityts.com)
#### Information & Sales
[](https://www.integrityts.com/)
- [Who We Are](https://www.integrityts.com/who-we-are/)
- [Industries](https://www.integrityts.com/industries/)
- [Services](https://www.integrityts.com/services/)
- [Pricing](https://www.integrityts.com/pricing/)
- [Blog](https://blog.integrityts.com/)
©2026 [Integrity Technology Solutions](https://www.integrityts.com/).
- [Privacy Policy](https://www.integrityts.com/privacy-policy/)
- [Terms & Conditions](https://www.integrityts.com/terms-and-conditions/)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Integrity Staff",
"url" : "https://blog.integrityts.com/author/integrity-staff"
},
"dateModified" : "2025-05-12T15:05:14.087Z",
"datePublished" : "2025-03-03T16:00:00.000Z",
"headline" : "Why You Need To Block Microsoft Legacy Authentication",
"image" : [ "https://blog.integrityts.com/hubfs/block-microsoft-legacy-authentication.jpg" ],
"mainEntityOfPage" : {
"@id" : "https://blog.integrityts.com/block-microsoft-legacy-authentication",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.integrityts.com/hubfs/Logos/integrity_1000x187.png"
},
"name" : "Integrity Technology Solutions"
}
}
```