How to Disable Legacy Authentication in Microsoft 365 Microsoft has already deprecated most legacy authentication protocols in Exchange Online. If your tenant hasn't caught up, you're facing both security risks and potential service disruptions. Let's walk through the essential steps to modernize your Microsoft 365 authentication security. Before we begin, be sure to subscribe to NinjaOne's IT video hub and our YouTube channel for more tech content like this. The Security Case for Disabling Basic Auth Modern security requires more than just a password. Basic Authentication is a massive liability because it lacks support for Multi-Factor Authentication (MFA) and can expose credentials through legacy authentication workflows that lack modern security protections. By disabling these legacy protocols, you eliminate the primary entry point for brute force and password spray attacks, forcing your environment to adopt OAuth 2.0 and modern authentication methods that support token- based identity and MFA enforcement. Environment Readiness and Admin Requirements Before making changes, verify your prerequisites. You need a Microsoft 365 tenant with Exchange Online and administrative rights— specifically Global, Security, or Conditional Access Admin roles. On the client side, users should run Outlook 2016 or newer, or Microsoft 365 Apps for enterprise. While basic Microsoft 365 licensing can support some configurations, Microsoft Entra P1 or P2 is recommended to unlock advanced features like Conditional Access. Tenant-Level Configuration (Admin Center & Entra ID) To secure your entire organization at once, you can apply restrictions through the global admin interfaces. Admin Center: Navigate to Settings > Org Settings > Modern Authentication to disable legacy protocols such as IMAP, POP, SMTP AUTH, Exchange Web Services, and Exchange ActiveSync. Conditional Access: Create a new Conditional Access policy in Microsoft Entra ID targeting "All cloud apps." Legacy Filtering: Under "Conditions," select "Client Apps" and select "Other clients" to target legacy authentication protocols. Enforcement: Under Access controls > Grant, select "Block access" to ensure only modern, MFA-capable applications can connect to your tenant. Client-Side Enforcement (PowerShell, Registry & GPO) In addition to tenant-level blocks, you can use technical controls to force modern authentication behavior directly on the user's device. PowerShell: Use the Set-CASMailbox command to disable specific protocols such as POP, IMAP, ActiveSync, or SMTP AUTH for individual users or bulk deployments. Group Policy: Enable "Modern Authentication" and "Disallow basic authentication" through Outlook 2016 Administrative Templates in Group Policy. Registry Editor: For single-device troubleshooting, set the AlwaysUseMSOAuthForAutoDiscover registry value to 1 to force Outlook to use OAuth-based authentication Automation: Remotely deploy registry changes, PowerShell scripts, and Group Policy updates across distributed endpoints at scale. Securing your tenant is a balance of administrative policy and client-side enforcement. While the transition may require user communication, auditing, and compatibility validation, it is one of the most effective ways to strengthen your Microsoft 365 security posture against credential-based attacks. Adopting these modern standards now ensures your organization remains compliant and protected against evolving credential-based threats. For more information, check out our official blog post on how to disable legacy authentication in Microsoft 365, linked in the description below.