Legacy authentication

Before modern, token-based sign-in became common, many applications authenticated by sending a username and password with every request. Mail clients using POP or IMAP, old Office versions and devices that send email over SMTP still work this way. These protocols have no step where the user can complete an MFA prompt, so a correct password alone is enough to get in.

That makes them the favorite route for automated attacks. Microsoft reports that more than 99 percent of password spray attacks and more than 97 percent of credential stuffing attacks against its cloud use legacy authentication. Blocking these protocols, with Conditional Access or security defaults, removes most of those attacks at once.

Example

A company requires MFA for all users, but a password spray still succeeds against a sales account. The sign-in logs show the attacker used IMAP, which the MFA policy never challenged. After a policy blocks legacy authentication, the same attempts fail before the password is even checked against the account.

Why it matters for a SOC analyst

In Entra ID sign-in logs, the Client app field shows the protocol used. Successful sign-ins over legacy protocols, especially from unfamiliar locations, are a strong sign of compromise, and failed ones in large numbers usually mean a password spray. Knowing which accounts still need these protocols also tells you where your MFA coverage has gaps.