# SharePoint Modern Auth Enforced

> This policy enforces the use of modern authentication protocols for SharePoint by disabling legacy authentication methods.

This policy enforces the use of modern authentication protocols for SharePoint by disabling legacy authentication methods. Modern authentication provides stronger security and supports features like multi-factor authentication, helping to protect organizational data.

## Settings this baseline controls

| Setting                       | What it does                                                                                                                                                                                                                                                                                                                                                                  |
| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Legacy authentication enabled | By default this value is set to $True, which means that authentication using legacy protocols is enabled. Setting this parameter to $False prevents Office clients using non-modern authentication protocols from accessing SharePoint Online resources. [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline turns off legacy authentication for SharePoint Online, so only modern
authentication reaches SharePoint Online and OneDrive. It applies to the whole tenant.

1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to
   many tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Leave **Legacy authentication enabled** set to Off. Microsoft's default for this
   setting is On, which means SharePoint still accepts sign-ins from Office clients and
   other apps using older, non-modern authentication protocols. Off blocks those sign-ins.
3. Before enforcing, check for line-of-business tools, sync agents or older Office clients
   in the tenant that still rely on legacy sign-in. Move them to a client that supports
   modern authentication first: unlike a Conditional Access policy, this baseline can't
   exclude specific apps or accounts.
4. Save. Turn on **Auto-remediation** and Octiga sets this back to Off automatically if
   something in Microsoft 365 re-enables legacy authentication for the tenant. Users on
   modern clients (Outlook, the SharePoint and OneDrive apps, a current browser) see no
   change either way.

> **Caution:** Any client still signing in with legacy authentication protocols loses access to
> SharePoint and OneDrive as soon as this enforces. Confirm nothing still depends on it
> before you enforce it on a live tenant.

> **Licence: SharePoint Online:** This baseline only applies to tenants with a SharePoint Online licence.

## Check it worked

Passing means SharePoint Online's `LegacyAuthProtocolsEnabled` setting reports `False`.
The same setting appears in the Microsoft 365 admin centre's baseline security settings as
"Block legacy client authentication connections to SharePoint and OneDrive with legacy
IDCRL protocol". The change can take up to 24 hours to apply on Microsoft's side, so give
it a day before re-checking a new deviation. Users on a modern client notice nothing;
anyone still on an old client gets an access-denied error the next time it tries to sign in.

## Standards this addresses

### CIS

- **M365 6.5.x** — CIS M365 Foundations Benchmark 6.5.x
- **v8 4.8** — CIS Controls v8 Safeguard 4.8

### NIST

- **PR.AC-1** — NIST CSF 2.0 PR.AC-1
- **IA-5** — NIST SP 800-53 IA-5
- **AC-17** — NIST SP 800-53 AC-17

### ISO 27001

- **A.8.15** — ISO/IEC 27001:2022 Annex A.8.15
- **A.8.16** — ISO/IEC 27001:2022 Annex A.8.16

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)