Question

Your organization wants to block legacy authentication protocols (such as POP, IMAP, and older Office clients) because they cannot enforce MFA. Before enforcing the block for all users, security management requires evidence of how many sign-ins would be affected, without impacting productivity. What is the recommended approach to gather this evidence using Conditional Access?

Accepted Answer

Create a Conditional Access policy that blocks legacy authentication and set it to Report-only mode, then review sign-in logs and the Conditional Access Insights workbook.

Answer

Enable Security Defaults, which will automatically block legacy authentication and log the affected users to the audit log.

Answer

Create a Conditional Access policy in the On state that blocks legacy authentication for a pilot group of five users, then extrapolate the results.

Answer

Configure a per-user MFA registration campaign and monitor the authentication methods activity report for legacy client usage.