Exchange Web Services (EWS) – A programming interface that’s used by Outlook, Outlook for Mac, and third-party apps.If you block Basic authentication for Exchange Online PowerShell, you need to use the Exchange Online PowerShell Module to connect. Exchange Online PowerShell – Used to connect to Exchange Online with remote PowerShell.

Exchange ActiveSync (EAS) – Used to connect to mailboxes in Exchange Online.Autodiscover – Used by Outlook and EAS clients to find and connect to mailboxes in Exchange Online.Authenticated SMTP – Used by POP and IMAP clients to send email messages.The complete list of all protocols that microsoft refers to as legacy authentication protocols: If you enforce basic MFA on all users, even if you implement Conditional Access without blocking and decommission legacy authentication it will be possible to bypass MFA and sign-in with basic username/password. Examples of protocols: MAP,POP,EWS,MAPI Over HTTP. Legacy Authentication is basically older basic authentication protocols that does not support Multi-Factor authentication. Lets deep into it! What is Legacy Authentication?

That being said, many organizations are still relying on legacy authentication protocols mostly within the Exchange Online workload, using protocols like IMAP,MAPI Over HTTP,AutoDiscover,EWS. Let’s face it, it’s really about time to start blocking old authentication protocols that is almost used in every single Password Spray Attack and Credential Stuffing attack against the Office 365 plattform.Īllowing these basic authentication protocols will leave you organization wide-open for easy attacks that sooner or later will lead to compromised accounts.

Due to the COVID-19 pandemic, they decided to postpone this to the second half of 2021 and later even to October 2022 Microsoft first announced that they would disable legacy authentication in the Exchange Online Service 13th of October 2020.

Legacy authentication office 365