Block legacy authentication in Microsoft 365

Check for existing legacy authentication

Do not enable the blocking policy without first checking what may be affected.

• Sign in to the Microsoft Entra admin centre.
• Select Entra ID.
• Go to Monitoring & health.
• Select Sign-in logs.
• Select Add filters.
• Select Client app.
• Select the legacy authentication methods displayed, which may include: Exchange ActiveSync, Exchange Web Services, IMAP, POP, SMTP, MAPI over HTTP and Other clients.
• Select Apply.
• Review both User sign-ins (interactive) and User sign-ins (non-interactive).
• Open each relevant record and identify the user account, the application or device, the legacy protocol being used, the source IP address and whether the attempt succeeded or failed.

Review an appropriate period—preferably at least 7 to 30 days—to account for applications that only run weekly or monthly.

Investigate affected devices and applications

Before blocking access, check for:

• Older versions of Microsoft Outlook or Office.
• Apple Mail, Android mail or other third-party email applications using old account configurations.
• Multifunction printers and scanners using authenticated SMTP.
• Applications using IMAP or POP to retrieve messages.
• Accounting, CRM, backup or reporting applications using Exchange Web Services.
• PowerShell scripts using stored usernames and passwords.
• Service accounts used by scheduled tasks.
• Migration, archiving or email journalling tools.

Upgrade or reconfigure these systems to use modern authentication, OAuth 2.0, Microsoft Graph, a supported email relay method, managed identities or application-based authentication.

Create an emergency access exclusion group

• In the Entra admin centre, go to Entra ID.
• Select Groups and then All groups.
• Select New group.
• Enter a descriptive name, such as: CA Exclusion – Emergency Access Accounts.
• Add only the authorised emergency access account or accounts.
• Secure these accounts with long, unique credentials and appropriate monitoring.
• Do not use emergency accounts for email, web browsing or everyday administration.

The exclusion should not be used for ordinary users, devices or applications that have not yet been upgraded.

Create the Conditional Access policy

In the Entra admin centre, go to Entra ID → Conditional Access → Policies and select New policy.

• Give the policy a clear name, such as: CA – Block Legacy Authentication.
• Under Assignments, select Users or workload identities. Under Include, select All users. Under Exclude, select Users and groups, choose the emergency access exclusion group created earlier, then select Done.
• Select Target resources. Under Include, select All resources or All cloud apps, depending on the wording displayed in your portal. Select Done.
• Under Conditions, select Client apps. Set Configure to Yes. Select only Exchange ActiveSync clients and Other clients. Select Done.
• Under Access controls, select Grant, then Block access, then Select.

“Other clients” covers legacy authentication clients such as older Office applications and clients using POP, IMAP, SMTP or other basic authentication protocols.

Start in Report-only mode

• Under Enable policy, select Report-only.
• Carefully review the policy summary.
• Confirm that all users are included, emergency access accounts are excluded, all resources are included, only legacy client applications are targeted and the access control is set to block.
• Select Create.

Report-only mode records what the policy would have done without blocking users. Microsoft recommends beginning in this mode before enforcement.

Monitor the policy impact

Leave the policy in Report-only mode long enough to capture normal business activity—typically at least 7 days, and preferably longer where monthly processes exist.

• Return to Entra ID and go to Monitoring & health.
• Select Sign-in logs.
• Add the Report-only status filter or column.
• Look for the new policy.
• Review results showing that the policy would have blocked access.
• Resolve each legitimate dependency before proceeding.

Do not disregard repeated failed legacy attempts. They may indicate an outdated system, an incorrectly configured device or an external password attack.

Conduct a pilot deployment

For larger or more complex organisations, test enforcement with a pilot group first.

• Open the Conditional Access policy.
• Change Users or workload identities from All users to a selected pilot group.
• Keep emergency access accounts excluded.
• Change Enable policy from Report-only to On.
• Save the policy.
• Test Outlook desktop and mobile, Teams, OneDrive and SharePoint, shared and delegated mailboxes, mobile email, printers and scanners, line-of-business applications, and automated scripts and reports.
• Monitor support requests and Entra sign-in logs.

Enable the policy for everyone

After all legitimate legacy authentication has been removed:

• Open CA – Block Legacy Authentication.
• Under Users or workload identities, select All users.
• Confirm the emergency access group remains excluded.
• Set Enable policy to On.
• Select Save.
• Confirm the policy shows as On in the policy list.

Verify enforcement

• Return to Monitoring & health → Sign-in logs.
• Filter by Client app, Conditional Access and Failure reason.
• Confirm legacy authentication attempts are being blocked.
• Test normal access using supported Microsoft 365 applications.
• Confirm the emergency access account can still access the tenant.
• Continue monitoring for several days after activation.