Legacy authentication is the digital equivalent of leaving a window open while you lock the front door. You might have turned on Multi-Factor Authentication (MFA) for every member of staff, but if legacy authentication is still active in your Microsoft 365 tenant, a hacker can often bypass that second layer of security entirely.
Modern authentication uses protocols like SAML or OAuth 2.0. These allow for those familiar 'approve' prompts on your phone. Legacy authentication, also known as basic authentication, is much older. It only understands a username and a password. It cannot prompt for a code or a thumbprint. Because it cannot handle MFA, attackers love it. If they have your password, they are in, regardless of your security settings.
What legacy authentication actually means
When we talk about legacy authentication, we are referring to older communication protocols used by email clients and applications to connect to Exchange Online. This includes protocols like Post Office Protocol (POP3), Internet Message Access Protocol (IMAP4), and older versions of Office like Outlook 2010. It also covers MAPI, RPC, and PowerShell sessions that do not use modern login prompts.
These protocols were designed when a password was considered enough. They do not support the modern security 'handshake' that allows Microsoft 365 to verify who you are via a separate device. If a protocol cannot ask for MFA, Microsoft 365 cannot enforce it. Disabling these entry points is one of the most effective steps you can take to secure your business.
The commercial risk of the MFA bypass
For a UK SME, the risk is financial and reputational. We often see Business Email Compromise (BEC) attempts that rely specifically on legacy authentication. An attacker uses a 'password spray' attack, where they try a common password like 'Winter2024!' against hundreds of accounts. If legacy authentication is enabled, they do not need to worry about the MFA prompt that would usually stop them.
Once inside, they often set up silent forwarding rules to monitor your invoices or send fraudulent payment requests to your clients. From a regulatory perspective, leaving legacy authentication enabled can be seen as a failure to implement adequate technical measures under UK GDPR. If you are working towards Cyber Essentials, you are required to ensure all cloud services are protected by MFA where available. If legacy authentication is active, your MFA is not fully enforced, which can lead to an audit failure.
Auditing your tenant before the big switch
You cannot simply flip a switch and hope for the best. If you have an old warehouse scanner, a legacy CRM, or a staff member still using a ten-year-old version of Outlook, they will lose access immediately. You need to see who is using these protocols before you block them.
- Sign in to the Microsoft Entra admin centre (formerly Azure AD).
- Navigate to 'Monitoring & health' and then 'Sign-in logs'.
- Click 'Add filters' and select 'Client app'.
- Under the Client app filter, tick all the boxes under 'Legacy Authentication Clients' (such as Authenticated SMTP, AutoDiscover, IMAP4, POP3).
- Review the list of users and IP addresses.
A pattern we see on most tenants we take on is that legacy authentication remains active for a handful of service accounts created years ago for printers or old web forms, often with no MFA and easily guessable passwords. These are the accounts that usually get hit first. If you see legitimate traffic, you must modernise those apps or devices before proceeding.
How to audit your tenant
Identify which users and devices are still using old protocols.
- 1Sign in to EntraUse the Microsoft Entra admin centre
- 2Open sign-in logsNavigate to monitoring and health then sign-in logs
- 3Filter client appsAdd filters and select the client app option
- 4Select legacy clientsTick boxes for IMAP4, POP3 and authenticated SMTP
- 5Review the resultsCheck the list of users and IP addresses
How to disable legacy authentication safely
Microsoft has disabled basic authentication by default for most new tenants, but if your organisation has been using Microsoft 365 for several years, it is likely still lurking in the background. There are two primary ways to handle this: Security Defaults or Conditional Access.
Security Defaults
For very small businesses with simple requirements, Microsoft offers 'Security Defaults'. When turned on, this automatically requires MFA for everyone and blocks all legacy authentication. It is an all-or-nothing setting. You can find this in the Entra admin centre under 'Properties' > 'Manage security defaults'. However, this is often too restrictive for businesses that need specific exceptions for hardware like scanners.
Conditional Access
For most UK SMEs, Microsoft 365 Business Premium is the better choice because it includes Entra ID P1. This allows you to use Conditional Access policies. These are 'if/then' rules. You can create a policy that says: 'If a user tries to sign in using a legacy protocol, then block access.' This gives you the granularity to exclude specific accounts, such as a dedicated printer account, while protecting the rest of the company.
We recommend creating a 'Block Legacy Auth' policy that targets all users but excludes a specific 'Emergency Access' account (to prevent you from locking yourself out) and any specific service accounts you have identified as essential. We suggest a Microsoft 365 security review to ensure these policies are configured correctly without leaving gaps.
Legacy authentication is the digital equivalent of leaving a window open while you lock the front door.
The SMTP AUTH exception for printers and scanners
The most common reason businesses hesitate to disable legacy auth is the office multi-function printer. These devices often use 'SMTP AUTH' to send scanned documents to email addresses. Many older printers do not support modern authentication.
You have three choices here. First, see if the printer supports 'OAuth' in its settings; many modern Xerox or Konica Minolta units do. Second, you can use a 'Direct Send' method or an Microsoft 365 SMTP Relay, which identifies the printer by its static IP address rather than a username and password. This is more secure because it does not require a password to be stored on the device. Third, if you must use SMTP AUTH, you should enable it only for that specific mailbox and enforce a very long, complex password, while keeping legacy auth blocked for everyone else.
The financial cost of a legacy auth breach
Consider a hypothetical UK firm with 25 employees. If one account is compromised via legacy authentication and used to send out 500 fake invoices, the fallout is serious.
- Direct Loss: If a client pays a £4,000 invoice to a hacker's account, you may face a dispute over who bears the loss.
- Investigation: A forensic IT investigation to ensure the attacker is fully purged can cost between £2,000 and £5,000.
- Downtime: If your email domain is blacklisted for spamming, your staff may be unable to communicate with clients for 48 hours. At an average UK salary, 25 people sitting idle or working at 50% capacity for two days costs the business roughly £3,500 in lost productivity.
- Insurance: Your cyber insurance premium will likely increase upon renewal following a claim.
Disabling legacy authentication costs nothing in licensing if you already have the right plan, and it takes an engineer only a few hours to audit and implement. The return on investment is immediate.
Estimated costs of a security breach
A security breach results in direct financial losses and productivity drops.
£4,000
Cost of a single fraudulent invoice paid to a hacker
48 hours
Downtime if your email domain is blacklisted for spamming
£3,500
Lost productivity for twenty five staff over two days
How Black Sheep Support helps
We make sure your security actually works for your staff without breaking the tools they rely on.
If you want to ensure your legacy authentication is fully disabled and your MFA is unbypassable
and we will help you map out a plan to secure your tenant. We also handle hardware, broadband, mobile and networking, ensuring your entire office infrastructure is as resilient as your email.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture. You can spend 30 to 60 minutes with one of our engineers on a Teams call to go through it, or spend 15 to 20 minutes doing it on your own with no commitment.
Legacy Authentication FAQ
Will disabling legacy authentication log my staff out of their phones? If your staff use the official Outlook app on iOS or Android, they will be fine as it uses modern authentication. If they use the built-in 'Mail' app on very old iPhones (iOS 10 or earlier), it may stop working. Most modern versions of the Apple Mail app support modern auth, but they might need to remove and re-add the account once the change is made.
What happens to my older versions of Office? Outlook 2010 and older do not support modern authentication at all. Outlook 2013 requires a specific registry change to enable it. Outlook 2016 and newer have it on by default. If your business is still running Office 2010, you are at significant risk and should upgrade to a modern Microsoft 365 management plan immediately.
Can I just use App Passwords instead? App Passwords are a workaround for legacy apps, but they are still a form of legacy authentication. They bypass MFA. While they are slightly better than using your main account password, they still represent a security gap. Our advice is to move away from them entirely in favour of modern authentication or managed service identities.
Does this affect IMAP and POP3? Yes. These are the primary legacy protocols. If you have a specific application that 'scrapes' a mailbox using IMAP, it will break when you disable legacy authentication. You should check with the software vendor to see if they support 'Graph API' or 'OAuth2' for IMAP, which are the secure modern alternatives.
How do I know if Microsoft has already disabled it for me? Microsoft has been proactively disabling these protocols for tenants that show no usage. You can check your 'Service Health' dashboard in the Microsoft 365 Admin Centre. Look for 'Message Centre' posts regarding 'Basic Authentication'. However, even if they have disabled some, they often leave SMTP AUTH enabled, so a manual check is always safer.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
