The settingWhat we hold this to
CreativeTechs minimum
A Conditional Access policy in state ENABLED (not report-only) targeting All users, client apps = Exchange ActiveSync + Other clients, grant = Block. Plus Exchange Online SmtpClientAuthenticationDisabled = true tenant-wide.
Benchmark position
CISA SCuBA MS.AAD.1.1 — legacy authentication SHALL be blocked. Same target; no gap.
Where the switch is
Entra admin centre → Protection → Conditional Access → Policies → New policy. Then separately: Exchange admin centre → Settings → Mail flow (or the PowerShell below) for SMTP AUTH.
How to verify
Get-TransportConfig | fl SmtpClientAuthenticationDisabled # expect True Graph: /identity/conditionalAccess/policies → state eq 'enabled', clientAppTypes contains 'exchangeActiveSync','other'
- Why it matters
- Legacy protocols — POP, IMAP, SMTP AUTH, EWS basic — bypass MFA entirely. The largest password-spray surface, and the thing that makes every other identity control conditional.
- How we check
- Maester MT.1015, CISA.MS.AAD.1.1. Secure Score BlockLegacyAuthentication.
- Fix — M365
- Conditional Access → all users → Client apps: Exchange ActiveSync + other clients → Block. Separately: Set-TransportConfig -SmtpClientAuthenticationDisabled $true
- Fix — Google
- Admin → Security → Less secure apps → Disable for everyone.
- User notices
- None — unless a copier, scanner or line-of-business app authenticates over SMTP AUTH. Audit before flipping.
- Expected pushback
- Rare. The scanner exception is the real one: move it to a modern-auth relay or a scoped account rather than leaving the tenant open.