CIS.M365.7.2.1 - (L1) Ensure modern authentication for SharePoint applications is required
Overview
SharePoint Online can accept sign-ins from legacy authentication protocols. Those protocols do not support multifactor authentication or conditional access, so anyone who obtains or sprays a password can reach SharePoint content without a second factor.
Blocking legacy protocols makes SharePoint sign-in use modern authentication only. Older clients and scripts that depend on basic authentication stop working until they are updated. A Conditional Access policy that blocks legacy authentication is the main control across Microsoft 365, so this SharePoint setting is a second layer that closes the same route in SharePoint itself.
Remediation action
- Sign in to the SharePoint admin center.
- Go to Policies > Access control.
- Under Apps that don't use modern authentication, select Block access.
- Select Save.
To apply the same setting with PowerShell, connect with Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive and run:
Set-PnPTenant -LegacyAuthProtocolsEnabled $false
Related links
- SharePoint admin center
- Set-PnPTenant
- Block legacy authentication
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.7.2.1 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Feature | Access control |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:7.2.1, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCisSpoModernAuthentication |
| Services | SharePointOnline |
Source
- Test:
tests/cis/Test.CIS.M365.7.2.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.7.2.1.md