Legacy Auth Conditional Access Policy - DEPRECATED NAME

Enforcing this policy will block access via insecure legacy authentication methods. This policy has been deprecated. It is still safe to use however it should be replaced with “Conditional Access Policy - Block Legacy Authetication” which can be added from the Octiga Best Practice Template.

Settings this baseline controls

Setting	What it does
Policy name	Specifies a display name for the conditional Access Policy Learn more
Enable policy	Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline still works and is safe to use, but it’s the older way to block legacy authentication. Block Legacy Authentication is the current baseline, carried in Octiga’s best-practice scheme; add that one on any tenant that doesn’t already have this older baseline deployed.

1. Add the baseline to the tenant directly (see Adding a baseline), or carry it in a scheme you deploy to every tenant you manage (see Deploying a scheme). It applies tenant-wide, with no per-user targeting to configure.

2. Set Enable policy to enabled to enforce it, or to enabledForReportingButNotEnforced first to see who’s still using legacy authentication before anyone loses access.

3. Save.

   Turn on Auto-remediation if you want Octiga to reapply this policy automatically whenever it’s changed in Microsoft 365.

Caution

Older mail clients and some line-of-business applications still rely on legacy authentication protocols and lose access as soon as this policy enforces. Check for recent legacy-protocol sign-ins on the tenant first, and give affected accounts time to migrate before switching Enable policy to enabled.

Licence: Entra ID P1 or P2

This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated (see Licence requirements).

Check it worked

After the next sync, this baseline shows Passing once a policy with state set to enabled and legacy client app types blocked exists in Microsoft Entra. Check it in the Microsoft Entra admin centre under Entra ID > Conditional Access > Policies. Users on modern authentication notice nothing. Anyone still connecting with a legacy protocol is refused access, so a legacy mail client or line-of-business app loses access to Exchange Online.

Standards this addresses

CISM365 5.2.2.3v8 4.8

NISTPR.PT-1AC-17IA-5

ISO 27001A.8.15A.8.16

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→