Block legacy authentication with Azure AD with Conditional Access

 

To give your users easy access to your cloud apps, Azure Active Directory (Azure AD) supports a broad variety of authentication protocols including legacy authentication. However, legacy authentication doesn't support things like multifactor authentication (MFA). MFA is a common requirement to improve security posture in organizations.

Identify legacy authentication use

Before you can block legacy authentication in your directory, you need to first understand if your users have clients that use legacy authentication. Below, you'll find useful information to identify and triage where clients are using legacy authentication.

Indicators from Azure AD

1. Navigate to the Azure portal > Azure Active Directory > Sign-in logs.
2. Add the Client App column if it isn't shown by clicking on Columns > Client App.
3. Select Add filters > Client App > choose all of the legacy authentication protocols and select Apply.