Legacy Authentication
Older authentication protocols (IMAP, POP3, SMTP AUTH, older Office clients) that cannot enforce multi-factor authentication.
What is Legacy Authentication?
Legacy authentication protocols were designed before MFA existed and have no mechanism to request or verify a second factor. Attackers specifically target these protocols to bypass MFA policies. Even with MFA required via Conditional Access, an attacker with a stolen password can authenticate through legacy protocols unless they are explicitly blocked.
In Microsoft 365
Azure AD Conditional Access can block legacy authentication using the "Client apps" condition. Microsoft recommends blocking legacy auth for all users (except documented service accounts). Sign-in logs show which users and apps still use legacy protocols.
Examples
- 1IMAP/POP3 email clients
- 2Old Office versions (Office 2010 and earlier)
- 3SMTP AUTH for sending mail
- 4ActiveSync without modern auth
Related TrueConfig Controls
These controls help implement and verify legacy authentication in your Microsoft 365 environment.