Block basic authentication with Conditional Accessįollow the below steps to block basic authentication, also known as legacy authentication with Azure AD Conditional Access. If necessary, you allow only certain users and specific network locations to use apps that are based on legacy authentication. How can you prevent apps using legacy authentication from accessing your tenant’s resources? The recommendation is to block them with a Conditional Access policy. With MFA, even if an attacker gets in possession of a user’s password, the password alone is not sufficient to successfully authenticate and access the data. One of the easiest things you can do to protect against password threats is to implement Multi-Factor Authentication (MFA). Passwords are also vulnerable to various attacks, like phishing and password spray. Passwords are bad as they are easy to guess, and we (humans) are bad at choosing good passwords. Single-factor authentication (for example, username and password) is not enough these days. Azure AD accounts in organizations that have disabled legacy authentication experience 67 percent fewer compromises than those where legacy authentication is enabled.More than 97 percent of credential stuffing attacks use legacy authentication.More than 99 percent of password spray attacks use legacy authentication protocols.The numbers on legacy authentication from an analysis of Azure Active Directory (Azure AD) traffic are clear: It’s because legacy authentication protocols like POP, SMTP, IMAP, and MAPI can’t enforce MFA, making them preferred entry points for adversaries attacking your organization. Why do you need to block basic authentication when you have Multi-Factor Authentication configured?įor MFA to be effective, you also need to block legacy authentication.

Why you should block basic authentication Block basic authentication with Conditional Access.Why you should block basic authentication.

Legacy authentication office 365