Conditional Access blocks legacy authentication

Check ID: entra_legacy_authentication_blocked
Provider: Microsoft 365
Service: entra
Severity: CRITICAL
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra Conditional Access has an active policy that blocks legacy authentication for All users and All cloud apps by targeting legacy client app types (e.g., Exchange ActiveSync, other basic-auth clients) and enforcing Block access.

Risk

Allowing legacy authentication enables password spray and credential stuffing that bypass MFA, leading to account takeover. Compromised sessions threaten confidentiality (mail, files), integrity (settings, data changes), and availability, and enable lateral movement across Microsoft 365.

Recommendation

Enforce a tenant-wide policy to block legacy authentication for All users and All cloud apps, targeting legacy client app types. Migrate apps and devices to modern authentication. Keep minimal, monitored exclusions for break-glass/service accounts, prefer managed identities, and apply zero trust and least privilege.

Remediation

CLI
Terraform
Dashboard steps

az rest --method post --url https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies --body '{"displayName":"<example_policy_name>","state":"enabled","conditions":{"users":{"includeUsers":["All"]},"applications":{"includeApplications":["All"]},"clientAppTypes":["exchangeActiveSync","other"]},"grantControls":{"builtInControls":["block"],"operator":"OR"}}'

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled" # critical: enforce the policy

  conditions {
    users {
      include_users = ["All"] # critical: include all users
    }
    applications {
      include_applications = ["All"] # critical: include all cloud apps
    }
    client_app_types = ["exchangeActiveSync", "other"] # critical: target legacy auth clients
  }

  grant_controls {
    built_in_controls = ["block"] # critical: block access
  }
}

References

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_legacy_authentication_blocked. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Microsoft 365 checks

Intune enrollment requires MFA every time Conditional Access requires a managed device to sign in

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires