Introduction
One of the most common security gaps we still see in small and mid-sized organizations is legacy authentication.
Even with strong passwords, legacy authentication allows attackers to bypass modern security controls like Multi-Factor Authentication (MFA)—making it a favorite entry point for cybercriminals.
In this blog, we’ll explain what legacy authentication is, why it’s dangerous, and how businesses can disable it safely.
What Is Legacy Authentication?
Legacy authentication refers to older sign-in methods that do not support modern security features, such as:
Basic authentication (username + password only)
POP, IMAP, SMTP AUTH
Older Office apps
Outdated third-party email clients
Because these methods don’t support MFA, attackers can brute-force credentials without triggering advanced protections.
Why Attackers Love Legacy Authentication
Legacy authentication:
❌ Bypasses MFA
❌ Is easy to brute force
❌ Often goes unnoticed in logs
❌ Is widely enabled by default
According to security reports, most cloud account compromises involve legacy authentication.
Real-World Attack Scenario
An attacker obtains a leaked password
They attempt thousands of login attempts using SMTP or IMAP
MFA is never triggered
Account access is granted
Email data is exfiltrated or used for phishing
All without raising immediate alarms.
How to Check If Legacy Authentication Is in Use
In Microsoft Entra ID, administrators can:
Review sign-in logs
Filter by legacy authentication clients
Identify users and applications still relying on it
This visibility is crucial before making changes.
How to Disable Legacy Authentication (Safely)
Step 1: Identify Dependencies
Email scanners
Old mobile devices
Line-of-business applications
Step 2: Enable Modern Authentication
Ensure users are using:
Outlook (modern versions)
Web-based access
OAuth-based apps
Step 3: Create a Conditional Access Policy
Block legacy authentication while allowing modern sign-ins.
Step 4: Roll Out in Phases
Start with:
Test users
IT admins
Low-risk groups
Then expand tenant-wide.
Common Business Concerns (Answered)
“Will email stop working?”
Only if outdated clients are still in use.
“Is MFA enough without disabling legacy auth?”
No. MFA can be bypassed if legacy auth is enabled.
“Is this required for cyber insurance?”
Increasingly, yes.
Final Thoughts
Disabling legacy authentication is one of the fastest and most effective security wins for any organization.
It costs nothing, reduces attack surface immediately, and strengthens every account in your environment.
If your organization hasn’t done this yet, it’s not a matter of if—but when—it will be exploited.