Disable Legacy Authentication to Prevent Password-Based Attacks

Legacy authentication protocols such as POP3, IMAP, SMTP AUTH, Exchange ActiveSync, and older Office clients do not support modern authentication and Multi-Factor Authentication (MFA). Attackers frequently abuse these protocols in password spraying and credential stuffing attacks because they can bypass Conditional Access and MFA protections.

Disabling legacy authentication is one of the most effective ways to reduce identity-based attacks in Microsoft 365 and hybrid environments.

Implementation Steps

• Identify users and applications still using legacy authentication.
• Enable Modern Authentication across Microsoft 365 services.
• Disable legacy authentication protocols such as POP3, IMAP, and SMTP AUTH where not required.
• Create Conditional Access policies to block legacy authentication.
• Update or replace applications that rely on outdated authentication methods.
• Monitor sign-in logs for blocked legacy authentication attempts.

If your organization has not yet enforced MFA, review the Enable Multi-Factor Authentication (MFA) guide before disabling legacy protocols.

You should also regularly review Conditional Access policies to ensure new applications cannot reintroduce legacy authentication.