Legacy auth blocking: phased approach
Overview
Blocking basic auth reduces credential stuffing—but kills old mail clients if unprepared.
Phase 0
Inventory sign-ins using legacy protocols from Entra reports; identify apps/devices.
Phase 1
Notify stakeholders with cut dates; provide approved modern clients.
Phase 2
CA policy block with narrow emergency group; shrink group weekly.
Watch-outs
** multifunction devices**, old PowerShell remoting—provide SMTP/modern alternatives.
Success
Near-zero legacy auth events; no surprise C-suite lockouts.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...