Enforce MFA and Block Legacy Authentication with Conditional Access

Password-only authentication is the root cause of the overwhelming majority of cloud account compromises. Password spray, credential stuffing, and phishing all succeed because a single secret is enough to get in. Microsoft's own telemetry consistently shows that MFA blocks well over 99% of automated identity attacks — but MFA only works if it cannot be bypassed, and legacy authentication protocols exist precisely to bypass it. These two Conditional Access policies belong together: one enforces MFA, the other closes the back door around it.

Why legacy authentication must die

• Legacy protocols — IMAP, POP3, SMTP AUTH, Exchange ActiveSync basic auth, and older Office clients — authenticate with only a username and password. They cannot perform MFA at all.
• Attackers know this: the vast majority of password spray campaigns specifically target legacy endpoints, because a valid password there means a successful sign-in regardless of any MFA registration.
• An environment with "MFA enabled" but legacy auth allowed is not protected — it just looks protected in reports.

Policy 1 — Require MFA for all users

• Target: all users, all cloud apps. Exclude only two emergency access ("break glass") accounts, secured with long random passwords stored offline, and monitored for any sign-in activity.
• Grant control: require multifactor authentication — or, on Entra ID P1 with modern methods deployed, require authentication strength so you can mandate phishing-resistant methods (FIDO2, Windows Hello for Business, passkeys) for admins.
• Create a second, stricter policy for administrator roles: phishing-resistant MFA, no exceptions, ideally combined with compliant device requirements.

Policy 2 — Block legacy authentication

• Target: all users; under Conditions > Client apps, select Exchange ActiveSync clients and Other clients. Grant control: Block access.
• Before enforcing, identify real usage: filter the Entra ID sign-in logs by Client App to see which accounts and IPs still authenticate with legacy protocols. Typical findings are multifunction printers doing scan-to-email, old service scripts, and users on ancient Outlook versions.
• Remediate stragglers properly: move scan-to-email to Microsoft 365 High Volume Email or an SMTP relay with modern auth, upgrade or replace legacy clients, and migrate scripts to OAuth-based authentication.

Rollout approach

• Deploy both policies in report-only mode first and review the results for one to two weeks. Report-only shows exactly which sign-ins would have been blocked, with zero user impact.
• Communicate the MFA registration campaign before enforcement, and use registration campaigns in Entra to nudge users toward Microsoft Authenticator rather than SMS.
• Enforce in waves if needed — pilot group, then departments, then everyone — but set a hard end date. Note that Microsoft's Security Defaults and managed Conditional Access policies now push tenants in this direction automatically; doing it deliberately gives you control over exclusions and timing.

These two policies are the foundation every other Microsoft 365 security control stands on. Deploy them before investing in anything more advanced — an attacker who can simply log in does not need to defeat your other defenses.