SharePoint Modern Auth Enforced
This policy enforces the use of modern authentication protocols for SharePoint by disabling legacy authentication methods. Modern authentication provides stronger security and supports features like multi-factor authentication, helping to protect organizational data.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Legacy authentication enabled | By default this value is set to $True, which means that authentication using legacy protocols is enabled. Setting this parameter to $False prevents Office clients using non-modern authentication protocols from accessing SharePoint Online resources. Learn more |
Configure it
This baseline turns off legacy authentication for SharePoint Online, so only modern authentication reaches SharePoint Online and OneDrive. It applies to the whole tenant.
-
Add the baseline to the tenant (Adding a baseline), or deploy it to many tenants at once as part of a scheme (Deploying a scheme).
-
Leave Legacy authentication enabled set to Off. Microsoft’s default for this setting is On, which means SharePoint still accepts sign-ins from Office clients and other apps using older, non-modern authentication protocols. Off blocks those sign-ins.
-
Before enforcing, check for line-of-business tools, sync agents or older Office clients in the tenant that still rely on legacy sign-in. Move them to a client that supports modern authentication first: unlike a Conditional Access policy, this baseline can’t exclude specific apps or accounts.
-
Save. Turn on Auto-remediation and Octiga sets this back to Off automatically if something in Microsoft 365 re-enables legacy authentication for the tenant. Users on modern clients (Outlook, the SharePoint and OneDrive apps, a current browser) see no change either way.
Check it worked
Passing means SharePoint Online’s LegacyAuthProtocolsEnabled setting reports False.
The same setting appears in the Microsoft 365 admin centre’s baseline security settings as
“Block legacy client authentication connections to SharePoint and OneDrive with legacy
IDCRL protocol”. The change can take up to 24 hours to apply on Microsoft’s side, so give
it a day before re-checking a new deviation. Users on a modern client notice nothing;
anyone still on an old client gets an access-denied error the next time it tries to sign in.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.