Turn off legacy authentication in Microsoft 365
Old mail protocols skip MFA, and password-spraying attacks love them. Most companies can block them in an afternoon.
You turned on MFA for Microsoft 365. Good. But if legacy authentication is still allowed, attackers can skip it.
Older protocols such as POP, IMAP, SMTP AUTH and old Exchange ActiveSync clients only send a username and password. No MFA prompt. Password-spraying attacks, trying a few common passwords against many accounts, target exactly these.
Microsoft is phasing out basic authentication for Exchange Online. Don’t wait for it:
- Check the sign-in logs for legacy protocols. You’ll see which users and apps still use them.
- Move those to modern clients: current Outlook, the mail apps on phones, or OAuth for scanners and apps.
- Block legacy authentication with security defaults or a conditional access policy.
- Keep an exception list short, named, and with an end date.
The old printer that sends scanned PDFs by email is usually the last one. Plan it, don’t let it keep the door open.