You can turn on multi factor authentication for every user and still be wide open, because legacy authentication does not support MFA and simply skips it. Attackers know this, which is why password spray attacks still target old protocols. Closing that hole is one of the highest value hours you can spend in a Microsoft 365 tenant. Here is how to do it without breaking anything.
Why legacy authentication is the hole
Legacy authentication is the set of older sign in methods that cannot prompt for a second factor: basic authentication, and older email protocols like POP, IMAP and SMTP AUTH, plus older Office clients and some scanners and line of business apps. When one of these signs in, it sends a username and password and that is it. Your Conditional Access policy that requires MFA never gets a chance to fire, because the client cannot do MFA in the first place. So a phished or sprayed password works, MFA or not.
Find out who is still using it
Before you block anything, see who would be affected, so there are no surprises. In the Entra admin centre, open Sign-in logs, and add a filter for Client app. Tick the legacy options, the ones grouped as "other clients", things like IMAP, POP, SMTP, MAPI, and other legacy. Look across at least a week, ideally thirty days to catch monthly jobs. What you are looking for is which accounts show legacy sign ins and what they are: real people on an old Outlook, or service accounts and devices like a scanner or a reporting script.
Most of the time the list is short and nearly all of it is one or two multifunction printers, a backup script, or an old application nobody remembered. Real users on legacy auth are rare on a reasonably current tenant.
Block it with Conditional Access, safely
The safe way is a Conditional Access policy, rolled out in report only mode first so you can see exactly who it would have blocked before it blocks anyone.
- Create a Conditional Access policy, assigned to all users, and exclude your break glass account. Always exclude the break glass account from every policy.
- Under Conditions, Client apps, select the legacy options, Exchange ActiveSync clients and other clients.
- Under Access controls, choose Block.
- Set it to Report-only and save. Leave it for a week and watch the report, which shows who would have been blocked without actually blocking them.
- Once the report shows only the accounts and devices you already dealt with, flip it from Report-only to On.
Microsoft has been retiring basic authentication in Exchange Online anyway, and is turning off SMTP AUTH where it is unused, so you are getting ahead of a change that is coming regardless. Blocking it yourself with a clear policy means you control the timing instead of being surprised by it.
The things that break, and the fixes
Almost everything that breaks is a device or a script, not a person, and each has a modern replacement.
- Scanners and multifunction printers that email scans over SMTP. Move them to a proper authenticated SMTP relay, or a connector, or a small mailbox that supports modern auth. Do not leave basic auth on for the whole tenant to keep one printer alive.
- Old Outlook or old operating systems. Update them. Current Outlook and current Windows and macOS all use modern authentication by default.
- Reporting or backup scripts using basic auth against a mailbox. Move them to an app registration with the right Graph permissions, which is both safer and auditable.
- Shared mailbox access from phones using old settings. The Outlook mobile app uses modern auth and handles shared mailboxes properly.
Done in this order, report only first and the devices sorted before you enforce, nobody gets locked out and the single biggest MFA bypass in your tenant is closed. It is exactly the kind of thing the $250 Health Check surfaces, and the kind of fix a Hardening project puts in properly.