Modern and Legacy Authentication Help

Question

Hi,

I want to block Legacy Authentication.

I have setup a Conditional Access Policy to block most clients and protocols connecting to my tenants apps.

So to my understanding this will -
Stop users connecting to my apps that are using clients and protocols that don't support modern authentication.
But it will not stop them from being able to send email to me from an app that doesn't support modern authentication.

Answer 1

Hi @IT-User9733

If you implement a conditional access policy as seen in https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication (How to: Block legacy authentication access to Azure AD with Conditional Access) you will then stop people from using basic authentication (legacy) and therefore force them to only use Modern Authentication.

Regardless of implementing this, legacy authentication will begin to be depreciated on October 1, 2022.

Your questions:

1) Stop users connecting to my apps that are using clients and protocols that don't support modern authentication.

Correct.

2) But it will not stop them from being able to send email to me from an app that doesn't support modern authentication.

Incorrect if you turn the policy on it will block legacy authentication to all apps. You should think about using MFA for all of your users by implementing the following:

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa

---

If this is helpful please mark as correct answer.

Answer 2

What is stopping someone sending me an email to my account from a client that does not support MA?

Thanks