# Legacy Auth Conditional Access Policy - DEPRECATED NAME

> Enforcing this policy will block access via insecure legacy authentication methods.

Enforcing this policy will block access via insecure legacy authentication methods. This policy has been deprecated.  It is still safe to use however it should be replaced with "Conditional Access Policy - Block Legacy Authetication" which can be added from the Octiga Best Practice Template.

## Settings this baseline controls

| Setting       | What it does                                                                                                                                                                                                                                                    |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Policy name   | Specifies a display name for the conditional Access Policy [Learn more](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication)                                                                                 |
| Enable policy | Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. [Learn more](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline still works and is safe to use, but it's the older way to block legacy authentication. [Block Legacy Authentication](https://docs.octiga.io/baselines/conditional-access-policy/cap-legacy-auth/) is the current baseline, carried in Octiga's best-practice scheme; add that one on any tenant that doesn't already have this older baseline deployed.

1. Add the baseline to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or carry it in a scheme you deploy to every tenant you manage (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). It applies tenant-wide, with no per-user targeting to configure.
2. Set **Enable policy** to `enabled` to enforce it, or to `enabledForReportingButNotEnforced` first to see who's still using legacy authentication before anyone loses access.
3. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply this policy automatically whenever it's changed in Microsoft 365.

> **Caution:** Older mail clients and some line-of-business applications still rely on legacy authentication protocols and lose access as soon as this policy enforces. Check for recent legacy-protocol sign-ins on the tenant first, and give affected accounts time to migrate before switching **Enable policy** to `enabled`.

> **Licence: Entra ID P1 or P2:** This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated (see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/)).

## Check it worked

After the next sync, this baseline shows **Passing** once a policy with `state` set to `enabled` and legacy client app types blocked exists in Microsoft Entra. Check it in the Microsoft Entra admin centre under **Entra ID > Conditional Access > Policies**. Users on modern authentication notice nothing. Anyone still connecting with a legacy protocol is refused access, so a legacy mail client or line-of-business app loses access to Exchange Online.

## Standards this addresses

### CIS

- **M365 5.2.2.3** — CIS M365 Foundations Benchmark 5.2.2.3
- **v8 4.8** — CIS Controls v8 Safeguard 4.8

### NIST

- **PR.PT-1** — NIST CSF 2.0 PR.PT-1
- **AC-17** — NIST SP 800-53 AC-17
- **IA-5** — NIST SP 800-53 IA-5

### ISO 27001

- **A.8.15** — ISO/IEC 27001:2022 Annex A.8.15
- **A.8.16** — ISO/IEC 27001:2022 Annex A.8.16

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)