# (L1) Ensure modern authentication for SharePoint applications is required

SharePoint Online can accept sign-ins from legacy authentication protocols.

Source: https://maester.dev/docs/tests/CIS.M365.7.2.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · SharePoint · Access control · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.7.2.1
```

## Overview

SharePoint Online can accept sign-ins from legacy authentication protocols. Those protocols do not support multifactor authentication or conditional access, so anyone who obtains or sprays a password can reach SharePoint content without a second factor.

Blocking legacy protocols makes SharePoint sign-in use modern authentication only. Older clients and scripts that depend on basic authentication stop working until they are updated. A Conditional Access policy that blocks legacy authentication is the main control across Microsoft 365, so this SharePoint setting is a second layer that closes the same route in SharePoint itself.

**Current service behavior:** Microsoft permanently retired the legacy IDCRL authentication protocol for SharePoint Online and OneDrive on May 1, 2026. This test still audits the SharePoint tenant setting required by CIS, but it does not inspect client traffic. Migrate any affected clients, scripts, or applications to OpenID Connect or OAuth; the retired protocol can no longer be re-enabled.

#### Remediation action

1. Sign in to the [SharePoint admin center](https://admin.microsoft.com/sharepoint).
2. Go to **Policies** > **Access control**.
3. Under **Apps that don't use modern authentication**, select **Block access**.
4. Select **Save**.

To apply the same setting with PowerShell, connect with `Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive` and run:

```powershell
Set-PnPTenant -LegacyAuthProtocolsEnabled $false
```

#### Related links

* [SharePoint admin center](https://admin.microsoft.com/sharepoint)
* [Set-PnPTenant](https://pnp.github.io/powershell/cmdlets/Set-PnPTenant.html)
* [Block legacy authentication](https://learn.microsoft.com/entra/identity/conditional-access/block-legacy-authentication)
* [Retirement of IDCRL authentication in SharePoint Online (MC1184649)](https://mc.merill.net/message/MC1184649)
* [Migrating from IDCRL authentication to modern authentication](https://devblogs.microsoft.com/microsoft365dev/migrating-from-idcrl-authentication-to-modern-authentication-in-sharepoint/)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.1](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.7.2.1 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Feature | Access control |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:7.2.1, nist-800-53-r5:IA-2 |
| PowerShell test | [Test-MtCisSpoModernAuthentication](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.7.2.1.ps1) |
| Services | SharePointOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.7.2.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.7.2.1.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.7.2.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.7.2.1.md)