Sign-in logs showing POP, IMAP, SMTP, or old Office clients
Client app details in Microsoft 365 logs help identify who or what still uses legacy authentication.
Identity security guide
Legacy Authentication Risk
Legacy authentication refers to older sign-in methods and protocols that were designed before modern MFA and Conditional Access became standard. In Microsoft 365 environments, POP, IMAP, SMTP AUTH, and older Office clients are common examples.
For small businesses, the risk is practical: an attacker with a stolen password may be able to authenticate through an older protocol that does not enforce the same protections as a modern browser or Outlook client. Blocking legacy authentication is one of the highest-value Microsoft 365 security improvements, but it should be planned so printers, scanners, and older apps do not break unexpectedly.
The explanation
What it means
Modern authentication supports stronger controls such as MFA, Conditional Access, device checks, and risk-based decisions. Legacy authentication usually presents a simpler username-and-password path.
The danger is not that every older protocol is actively malicious. The issue is that attackers prefer the weakest available door. If modern sign-ins require MFA but an older mail protocol still accepts only a password, the tenant has an avoidable gap.
How it affects small businesses
Small offices often discover legacy authentication through old scan-to-email setups, accounting software connectors, mobile mail apps configured years ago, or former IT decisions nobody documented. These dependencies are normal, but they need to be identified before enforcement.
A clinic may rely on a multifunction printer to send scanned forms. A law office may have an older mail client on a partner laptop. An accounting firm may use SMTP AUTH for a line-of-business app. Security improvement should preserve operations while replacing weak authentication paths.
MFA bypass risk
Older protocols may allow password-only authentication even when users believe MFA protects the account.
Silent operational dependencies
Printers, scripts, and older applications often fail without clear user-facing errors.
Low attacker effort
Legacy protocols are easy to test automatically once usernames and passwords are obtained.
Warning signs
Signals to watch for
Scan-to-email using a mailbox password
Printer workflows that authenticate directly to Microsoft 365 often need redesign before blocking SMTP AUTH.
Unexpected successful sign-ins without MFA prompts
Password-only access paths should be reviewed immediately.
Users with very old Outlook or mobile mail configurations
Older clients may need updates, account reconfiguration, or replacement.
Reduce risk
First controls to put in place
Inventory legacy usage before blocking
Review sign-in logs for legacy client apps over a representative period so business dependencies are visible.
Disable legacy authentication
Use tenant settings and Conditional Access controls to block old protocols once exceptions have been remediated.
Move to modern authentication
Update Outlook, mobile apps, and connectors so they can support MFA and Conditional Access.
Replace weak scan-to-email patterns
Use supported relay, application-specific options, or vendor-recommended modern methods rather than a shared mailbox password.
Monitor after enforcement
Expect a short cleanup period. Logs help distinguish a real outage from an old device that needs reconfiguration.
What we look at during a review
When we assess identity security, these are the specific areas we check against your actual Microsoft 365 tenant.
Legacy client app report
We identify users, protocols, source locations, and devices still authenticating with older methods.
Operational dependency review
We map printers, scanners, apps, and service accounts that may be affected before enforcement.
Conditional Access and Security Defaults alignment
We verify that the chosen Microsoft 365 security model blocks legacy paths without creating unmanaged gaps.
Post-change validation
We check mail flow, scan-to-email, user sign-ins, and alerts after the change so the cleanup is controlled.
Continue learning
More identity attack guides
Need this mapped to your own tenant?
We can review your Microsoft 365 sign-in posture, MFA coverage, Conditional Access policies, legacy auth exposure, admin roles, and mailbox permissions — practical and scoped to a small team.
no obligation~30 minutesGTA-based engineers
FAQ
Identity attack questions answered
4 results
CoverageAre identity attacks mostly a Microsoft 365 problem?
Microsoft 365 is a common target because email, files, Teams, and identity all meet there. The same principles apply to Google Workspace, accounting portals, CRM systems, and remote access tools.
SecurityCan MFA be bypassed?
MFA greatly reduces risk, but active session theft, phishing proxies, OAuth consent abuse, and compromised devices can still create access. That is why Conditional Access, endpoint protection, and logging matter.
SecurityWhat should we check first after a suspected mailbox compromise?
Revoke sessions, reset the password and MFA methods, review inbox and forwarding rules, check sign-in logs, inspect sent mail, and preserve audit logs before cleanup.
CoverageDo small businesses need separate admin accounts?
Yes. Admin accounts should be separate from daily email accounts, protected with strong MFA, and used only for administration.