Here’s the short version: disable legacy authentication in Microsoft 365 or MFA is still optional for anything that speaks basic auth. Microsoft already turned off basic IMAP, POP, and EAS in Exchange Online. The leftover is SMTP AUTH, copiers, and client types Entra still labels legacy. Stolen passwords walk in that side door.
We keep finding tenants with Authenticator on every human and a copier still sending as the bookkeeper with a password. That password is the incident. This page is the inventory, the policy, and the week you actually turn the side door off.
Microsoft publishes a Conditional Access template to block legacy authentication. Use it after you know what will break. Pair it with MFA and Conditional Access so you are not blocking protocols while still skipping MFA on shared mail.
What legacy authentication still means in 2026
Legacy here is basic authentication: username plus password in older protocols, plus a few client types Entra still labels “legacy.” It is not “any mail client that is not Outlook.” Many third-party clients speak modern auth. Many devices do not.
Microsoft already deprecated basic authentication in Exchange Online for Exchange ActiveSync, POP, IMAP, EWS, Autodiscover, and several Outlook paths. That deprecation is real. It is not the whole job. SMTP AUTH with a username and password is still around. Entra Conditional Access still has a “legacy authentication” client-app condition that is a separate control.
What still shows up in small tenants:
- A copier or scanner using SMTP AUTH with a user password
- iPhone Mail or a POP client still trying basic auth (it should fail; if it does not, you have a hole)
- Outlook 2010 / very old Office that never moved
- App passwords issued years ago and never revoked
- A monitoring tool that logs in as a shared mailbox
- Certificate-based clients that Entra still treats as legacy when a CA policy says “block legacy”
If it cannot do MFA, treat it as hostile until proven otherwise. CISA’s MFA guidance is pointless if a password-only protocol is still on. MFA on the human does not protect the protocol that never asks for a second factor.
How to see who still uses it
Open Entra sign-in logs. Filter for client apps that scream IMAP, SMTP, Exchange ActiveSync, or “Other clients.” Seven days of logs is a start. Thirty is better.
How to read a legacy row
You want four columns: user, app or protocol, IP or location, last seen. Then label each row:
| Label | What you do |
|---|---|
| Person on an old client | Move them to Outlook or a modern client |
| Device on SMTP AUTH | Dedicated mailbox or a new submit path |
| Dead mailbox still authenticating | Revoke sign-in. That is not a protocol project. |
| Country you do not staff | Incident response, not a Friday cutoff |
Look at user-agent and IP. Home-cable IMAP at 11 p.m. is someone’s personal phone. Office subnet SMTP every morning is the copier. A country you do not staff is an incident.
Export, then sit with the office manager for thirty minutes. They will name the copier. They will not name the abandoned app password. You will.
Do not disable on Friday afternoon from a gut feeling. Put the CA policy in report-only first if you can. Watch a week. Then enforce.
Security Defaults vs Conditional Access
Security Defaults block legacy authentication for many tenants and force MFA. They are better than nothing. They are also a blunt instrument: you cannot stage a printer mailbox, you cannot report-only, and a later move to Conditional Access is how exceptions get lost.
If the tenant already has Conditional Access, use CA. Do not leave Defaults on “because Microsoft said so” and also run CA. Pick one identity baseline and document it.
If you already ran Security Defaults, some of this may already be blocked. Confirm in logs. Defaults plus a later CA migration is how a hole opens again. Logs decide. A feeling does not.
How to disable legacy authentication without breaking mail
Microsoft’s block-legacy template is the right shape: all users, all cloud apps, condition Client apps = legacy, grant block. Exclude a break-glass account. Exclude a dedicated scanner mailbox only if you must, with an expiry date on the exception.
That CA policy is the Entra-side control. Exchange has a second layer: authentication policies that disable basic auth per protocol. Use both if you like. Do not use neither.
Protocol toggles without CA still leave older client types that Entra can see. CA without reading logs is how you brick the copier on Monday and roll the policy back forever.
Report-only is not optional in a firm that still has a scanner. You want a week of “would have blocked” rows, named owners, and a help-desk note before the grant flips to block.
Printers, scanners, and SMTP AUTH
This is the stall. Someone will say the copier must send as users. Microsoft’s SMTP AUTH client submission docs are the product reference: disable SMTP AUTH for the organization, then enable it only on the mailboxes that still require it.
Options that actually work:
- Dedicated mailbox with a long password, no interactive sign-in, no Teams, no SharePoint, CA exception that expires.
- Connector or a submit path you actually document, not “the vendor said port 587.”
- Stop scanning to user mailboxes. Scan to a library.
Option 3 is the adult option. Option 1 is the compromise. “Leave basic auth on for everyone” is how you fail the insurance form and the next business email compromise.
Tenant-wide off, mailbox on
Turn SMTP AUTH off tenant-wide. Turn it on for the one mailbox. That is the opposite of what most offices did in 2018.
Vendor risk applies to the copier vendor who swore the firmware would support modern auth “next year.” Calendar the kill date. The promise is not a control.
Questions that stall the cutoff:
“Our bookkeeper uses Mail on iPhone.” Outlook for iOS speaks modern auth. The Mail app with a stored password is the problem, not the bookkeeper.
“The vendor said the app needs basic auth.” Ask them for the modern-auth document. If they have none, you have a vendor decision, not a tenant decision. Time-box the exception.
“We tried once and mail broke.” That usually means SPF, a scanner, and IMAP were changed in the same hour with no inventory. Do the inventory. Report-only. Then one change.
“Microsoft already blocked it.” Maybe. Logs decide.
These are cybersecurity questions dressed as copier questions. Treat them as identity.
App passwords and leftover clients
App passwords exist to bypass MFA for old clients. If you still issue them, you are manufacturing side doors. Revoke unused ones. Stop issuing new ones unless a named device has no other path, then calendar the kill date.
A stolen app password is a stolen password that MFA will not see.
Current Outlook, Outlook on the web, and Microsoft 365 Apps use modern authentication. They keep working when you disable legacy authentication. What breaks is the museum: Outlook 2010, a POP client on a warehouse PC, a line-of-business app last updated when the firm had a SBS box.
If a person is on IMAP, the fix is Outlook or a modern client, not an exception. Managed help desk should know this is coming so the tickets have a script: install Outlook, remove the Mail profile, confirm modern auth, close.
A one-week cutoff
Run it as five working days, not a weekend surprise:
- Export logs. Legacy sign-ins, last 30 days. Name owners. Label person, device, abandoned, or hostile.
- Move people. Anyone on IMAP gets Outlook or a modern client. Help desk owns the tickets.
- Isolate devices. Dedicated mailboxes or connectors. Write the exception with an owner and a date. Revoke old app passwords.
- Report-only CA. Block legacy, report-only. Watch. Confirm break-glass is excluded.
- Enforce. Turn the grant to block. Tell the office. Watch logs for 48 hours. Screenshot the policy and a log sample for insurance.
A 22-person professional firm we worked with had MFA on every person and a Konica that sent scans as the office manager. Sign-in logs showed that mailbox doing SMTP AUTH from the office subnet every weekday at 8:41 a.m. We gave the copier a dedicated mailbox with no Teams, no SharePoint, and a CA exception that expired in 60 days. People moved off IMAP in three days. Report-only for a week. Then block. The copier vendor promised modern auth “on the next firmware.” The calendar, not the promise, is the control.
Nobody lost mail. Two people lost the Mail app on a personal iPhone and gained Outlook. That is the usual trade.
Write exceptions. Owner, mailbox, why, kill date. Put the date on a calendar, not in a comment. When the date hits, help desk removes the CA exclusion. If the copier still cannot speak modern auth, you replace the copier or you accept the risk in writing for insurance. Silent forever-exceptions are how basic auth survives every “hardening” project.
Break-glass stays excluded. Daily users do not.
Printable cutoff checklist
- Export 30 days of legacy or basic-auth sign-ins.
- Label each row: person, device, abandoned, or hostile.
- Move people to Outlook or a modern client.
- Give devices a dedicated mailbox or a dated CA exception. SMTP AUTH off tenant-wide, on for that mailbox only.
- Revoke old app passwords.
- Put break-glass on the exclude list. Nobody else.
- CA policy, report-only, one week.
- Enforce. Watch 48 hours.
- Screenshot the policy and a log sample for insurance.
- Calendar the exception kill dates.
If you cannot complete 1 through 4, you are not ready for 8. That is not cowardice. That is how you avoid a self-inflicted outage that gets the policy rolled back forever.
Disabling legacy auth is not a full Microsoft 365 security checklist. It is one item that makes the rest of the checklist true. It is not a reason to skip passkeys for admins. It is not a DMARC substitute. Business email compromise loves basic auth because the password is enough. Close the door.
What the questionnaire actually wants
“Do you block legacy authentication?” is a yes or a story. The story is worse. Logs plus a CA policy screenshot are the evidence.
If you want logs read and the policy enforced without killing the copier on a Monday, contact Secure Techies. We work from Canoga Park. We will name what still speaks basic, and we will not leave an exception without a date. Bring the last 30 days of sign-in logs if you can export them. That file is the meeting.
Frequently Asked Questions
