# (L1) Enable Conditional Access policies to block legacy authentication

An enabled Conditional Access policy blocks sign-ins from legacy authentication clients for all users.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.2.3
```

## Overview

An enabled Conditional Access policy blocks sign-ins from legacy authentication clients for all users.

Legacy authentication protocols such as POP, IMAP, SMTP AUTH and older Office clients do not support multifactor authentication. An attacker who has a password can use them to sign in without the MFA prompt, and password spray tools target them first.

The policy must apply to all users and all cloud apps, select both **Exchange ActiveSync clients** and **Other clients**, block access and be enabled. Check the sign-in logs for legacy usage first, because blocking breaks applications that still depend on these protocols.

User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**.
3. Under **Users**, include **All users**. Exclude your emergency access accounts.
4. Under **Target resources**, select **All resources (formerly All cloud apps)**.
5. Under **Conditions** > **Client apps**, set **Configure** to **Yes** and select **Exchange ActiveSync clients** and **Other clients** only.
6. Under **Grant**, select **Block access**.
7. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**.

#### Related links

* [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)
* [Block legacy authentication with Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication)
* [Block legacy authentication to Microsoft Entra ID](https://learn.microsoft.com/entra/identity/conditional-access/block-legacy-authentication)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.3](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.2.3 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.3, nist-800-53-r5:CM-7 |
| PowerShell test | [Test-MtCisBlockLegacyAuthentication](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.3.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.2.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.3.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.2.3.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.3.md)