(L1) Ensure modern authentication for SharePoint applications is required

Contributed by jeremy finneyAll contributors →

Part of CIS · SharePoint · Access control · All checks

Run this check

Invoke-Maester -TestId CIS.M365.7.2.1

Overview

SharePoint Online can accept sign-ins from legacy authentication protocols. Those protocols do not support multifactor authentication or conditional access, so anyone who obtains or sprays a password can reach SharePoint content without a second factor.

Blocking legacy protocols makes SharePoint sign-in use modern authentication only. Older clients and scripts that depend on basic authentication stop working until they are updated. A Conditional Access policy that blocks legacy authentication is the main control across Microsoft 365, so this SharePoint setting is a second layer that closes the same route in SharePoint itself.

Current service behavior: Microsoft permanently retired the legacy IDCRL authentication protocol for SharePoint Online and OneDrive on May 1, 2026. This test still audits the SharePoint tenant setting required by CIS, but it does not inspect client traffic. Migrate any affected clients, scripts, or applications to OpenID Connect or OAuth; the retired protocol can no longer be re-enabled.

Remediation action

1. Sign in to the SharePoint admin center.
2. Go to Policies > Access control.
3. Under Apps that don’t use modern authentication, select Block access.
4. Select Save.

To apply the same setting with PowerShell, connect with Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive and run:

Set-PnPTenant -LegacyAuthProtocolsEnabled $false

Related links

• SharePoint admin center
• Set-PnPTenant
• Block legacy authentication
• Retirement of IDCRL authentication in SharePoint Online (MC1184649)
• Migrating from IDCRL authentication to modern authentication
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.1

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.7.2.1
Severity	Medium
Suite	CIS
Product	SharePoint
Feature	Access control
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1110 Brute Force
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.1
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:7.2.1, nist-800-53-r5:IA-2
PowerShell test	Test-MtCisSpoModernAuthentication
Services	SharePointOnline

Source

• Test: tests/cis/Test.CIS.M365.7.2.1.ps1
• Documentation: tests/cis/Test.CIS.M365.7.2.1.md