CIS.M365.5.2.2.3 - (L1) Enable Conditional Access policies to block legacy authentication
Overview
An enabled Conditional Access policy blocks sign-ins from legacy authentication clients for all users.
Legacy authentication protocols such as POP, IMAP, SMTP AUTH and older Office clients do not support multifactor authentication. An attacker who has a password can use them to sign in without the MFA prompt, and password spray tools target them first.
The policy must apply to all users and all cloud apps, select both Exchange ActiveSync clients and Other clients, block access and be enabled. Check the sign-in logs for legacy usage first, because blocking breaks applications that still depend on these protocols.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Conditions > Client apps, set Configure to Yes and select Exchange ActiveSync clients and Other clients only.
- Under Grant, select Block access.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Block legacy authentication with Conditional Access
- Block legacy authentication to Microsoft Entra ID
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.3
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.3 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.3, nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCisBlockLegacyAuthentication |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.3.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.3.md