CIS - Block legacy authentication

Policy conditions

Users

All users

Apps

All cloud apps

{
  "templateId": null,
  "displayName": "CIS - Block legacy authentication",
  "modifiedDateTime": null,
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "exchangeActiveSync",
      "other"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "block"
    ],
    "customAuthenticationFactors": [],
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('d6d696af-5a31-4ace-9187-e8ff3a54d868')/grantControls/authenticationStrength/$entity",
    "authenticationStrength": null
  },
  "Tag": "CIS",
  "summary": "The CIS - Block legacy authentication policy blocks all users from authenticating to any cloud app using legacy authentication protocols such as POP, IMAP, and SMTP AUTH. These protocols do not support modern authentication methods like MFA, making them a common target for credential stuffing and password spray attacks. Blocking them is one of the most impactful changes you can make to harden your tenant, though it is worth confirming no old clients still depend on these protocols first."
}