At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync
MT.1010HighEntra IDConditional Access
Part of Maester · Entra ID · Conditional Access · All checks
Invoke-Maester -TestId MT.1010Overview
Section titled “Overview”Legacy authentication is an unsecure method to authenticate. This function checks if the tenant has at least one Conditional Access policy that blocks legacy authentication.
Learn more: https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy
Remediation action
Section titled “Remediation action”Review the configuration described above.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1010 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Related products | Exchange Online |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCaBlockLegacyExchangeActiveSyncAuthentication |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
Section titled “Source”- Test:
tests/maester/entra/Test.MT.1010.ps1 - Documentation:
tests/maester/entra/Test.MT.1010.md