Legacy authentication SHALL be blocked

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Part of CISA · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.1.1

Overview

Legacy authentication SHALL be blocked.

Rationale: The security risk of allowing legacy authentication protocols is they do not support MFA. Blocking legacy protocols reduces the impact of user credential theft.

Remediation action:

Follow the guide below to create a Conditional Access policy that blocks legacy authentication.

• Block legacy authentication - Microsoft Learn

Related links

• CISA Legacy Authentication - MS.AAD.1.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.1.1
Severity	High
Suite	CISA
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1110 Brute Force, T1078.004 Cloud Accounts
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.1.1
Criticality	SHALL
Upstream requirement	MS.AAD.1.1v1
Supports controls	cisa-scuba:MS.AAD.1.1, nist-800-53-r5:CM-7
PowerShell test	Test-MtCisaBlockLegacyAuth
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.1.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.1.1.md