Legacy authentication must be blocked by Conditional Access

Requirement

A Conditional Access policy must be enabled that blocks legacy authentication protocols (Exchange ActiveSync, IMAP4, POP3, SMTP AUTH, other) for all users. Legacy auth bypasses MFA and is the leading vector for credential-stuffing attacks on Microsoft 365.

Remediation guidance

Create a Conditional Access policy targeting all users, all cloud apps, client app types = exchangeActiveSync + other → grant = block. Roll out in report-only mode for 7 days first to catch service accounts.

Evidence specification

{
  "query": "conditional_access_policies",
  "required_fields": [
    "id",
    "displayName",
    "state",
    "conditions",
    "grantControls"
  ]
}

Recent evaluations (Apollo Gaming Ltd.)