A client can have MFA registered for every user and still be open to a password-only attack. The reason is legacy authentication, and it's one of the first things an insurer's security questions are trying to catch.

What legacy authentication is

Legacy (or "basic") authentication sends a username and password with each request and has no way to show an MFA prompt. It was used by older Outlook versions and by mail protocols such as POP, IMAP and SMTP AUTH.

If the tenant still accepts it anywhere, an attacker with a stolen password can sign in through that route and never see the MFA step. Password-spray attacks target these routes for exactly that reason.

Hasn't Microsoft already turned it off?

Mostly. Microsoft disabled basic authentication for most Exchange Online protocols in 2022 and has been retiring it for SMTP AUTH as well. But that doesn't settle the question:

  • Insurers ask whether you block it, not whether Microsoft does.
  • Printers, scanners and line-of-business apps are often the last things still trying to use it.
  • Blocking it in Conditional Access covers every app that signs in through Microsoft Entra, not only Exchange.

How to find it

Open the sign-in logs in the Microsoft Entra admin center and add a filter on Client app. Select the legacy options, such as "Other clients", IMAP, POP and Authenticated SMTP.

Any results show which accounts and devices still depend on it. The logs go back 7 days on the free tier and 30 days with Entra ID P1, so check more than once if the client is quiet.

How to block it safely

  1. Create the policy in report-only mode. Microsoft's Conditional Access templates include "Block legacy authentication". Apply it to all users, set it to report-only, and leave it for a week.
  2. Review what would have been blocked. Check the sign-in logs for report-only results and list every account or device affected.
  3. Fix those first. Move scanners to an SMTP relay connector, update old Outlook versions, and switch third-party apps to modern sign-in.
  4. Turn the policy on. Then keep an eye on the logs for a few days after.

Conditional Access needs Microsoft Entra ID P1, included in Business Premium. Tenants without it can use Security Defaults, which blocks legacy authentication automatically.

What to tell the client

Keep it simple: "Some old sign-in methods let attackers skip the security code. We're switching them off, and we've checked nothing you use depends on them." That's also an honest answer for the insurance form.

See whether it's blocked today. The Cyber Insurance Readiness Check reads the tenant's Conditional Access and Security Defaults settings and tells you whether legacy sign-in is blocked.