Conditional access policy - block legacy authentication

Question

Conditional access policy - block legacy authentication

Ajay Patole 0

I have configured the block legacy authentication policy for a customer and what to verify it. How can I check if this policy is working or not. Can someone please help on this, with the steps to check this or any steps which would generate some logs to verify.

Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-17T05:08:20.2833333+00:00
Hey Ajay, you can verify your Block Legacy Authentication policy is working by checking sign-in logs in the Entra admin center or via logs you’ve routed to Azure Monitor. Here’s how:

In the Azure portal, open Microsoft Entra ID and go to Monitoring & health -> Sign-in logs.

Add the Client App column (click Columns -> select Client App).

Filter for legacy protocols:

On the Sign-in logs tab, click Add filters -> Client App -> select Exchange ActiveSync, Other clients (IMAP, POP, SMTP, etc.) -> Apply.

Repeat under the User sign-ins (non-interactive) tab if needed.

Review an entry:

On the Basic info pane you’ll see Conditional access status. A blocked legacy attempt shows something like Failure – BlockedByConditionalAccess.

Switch to the Conditional access tab to see exactly which policy applied.

If you’ve streaming logs to Log Analytics, you can Kusto-query the SigninLogs table:
SigninLogs | where ClientAppUsed in ("Exchange ActiveSync","IMAP","POP3","SMTP","Other") | where ConditionalAccessStatus == "failure" | project TimeGenerated, UserPrincipalName, ClientAppUsed, ConditionalAccessStatus, ConditionalAccessPolicies

(Optional) Use the What If tool on your policy blade to simulate the policy for a test user/app and see whether it would block legacy authentication.

That should give you clear evidence the policy is firing and blocking any legacy-auth attempts.

References:

https://learn.microsoft.com/azure/active-directory/conditional-access/block-legacy-authentication

https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication#identify-legacy-authentication-use

https://learn.microsoft.com/entra/identity/monitoring-health/how-to-view-applied-conditional-access-policies

https://learn.microsoft.com/entra/identity/conditional-access/troubleshoot-conditional-access
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-18T07:43:43.34+00:00

Ajay Patole

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.

1 answer

Your answer

Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-17T05:08:20.2833333+00:00

Hey Ajay, you can verify your Block Legacy Authentication policy is working by checking sign-in logs in the Entra admin center or via logs you’ve routed to Azure Monitor. Here’s how:

In the Azure portal, open Microsoft Entra ID and go to Monitoring & health -> Sign-in logs.

Add the Client App column (click Columns -> select Client App).

Filter for legacy protocols:

On the Sign-in logs tab, click Add filters -> Client App -> select Exchange ActiveSync, Other clients (IMAP, POP, SMTP, etc.) -> Apply.

Repeat under the User sign-ins (non-interactive) tab if needed.

Review an entry:

On the Basic info pane you’ll see Conditional access status. A blocked legacy attempt shows something like Failure – BlockedByConditionalAccess.

Switch to the Conditional access tab to see exactly which policy applied.

If you’ve streaming logs to Log Analytics, you can Kusto-query the SigninLogs table:
SigninLogs | where ClientAppUsed in ("Exchange ActiveSync","IMAP","POP3","SMTP","Other") | where ConditionalAccessStatus == "failure" | project TimeGenerated, UserPrincipalName, ClientAppUsed, ConditionalAccessStatus, ConditionalAccessPolicies

(Optional) Use the What If tool on your policy blade to simulate the policy for a test user/app and see whether it would block legacy authentication.

That should give you clear evidence the policy is firing and blocking any legacy-auth attempts.

References:

https://learn.microsoft.com/azure/active-directory/conditional-access/block-legacy-authentication

https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication#identify-legacy-authentication-use

https://learn.microsoft.com/entra/identity/monitoring-health/how-to-view-applied-conditional-access-policies

https://learn.microsoft.com/entra/identity/conditional-access/troubleshoot-conditional-access
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-18T07:43:43.34+00:00

Ajay Patole

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.

Answer 1

To verify that a Conditional Access policy blocking legacy authentication is working, use Microsoft Entra sign-in logs and filter specifically for legacy protocols.

Sign in to the Microsoft Entra admin center as at least a Reports Reader.
Go to Entra ID > Monitoring & health > Sign-in logs.
Select Columns and ensure Client App is enabled so it appears in the grid.
Select Add filters > Client App.
In Client App, select all legacy authentication protocols (for example, POP, IMAP, SMTP, older Office clients) and select Apply.
Repeat steps 3–5 on the User sign-ins (non-interactive) tab.
Review the filtered sign-ins:
- If the policy is correctly blocking legacy authentication, affected sign-ins should show as failures with Conditional Access indicating the block.
- Selecting an individual sign-in and reviewing Basic info and the Conditional Access tab will show which policy applied and that the legacy protocol was used.

To further triage and monitor legacy authentication usage and confirm reduction over time, use the Sign-ins using legacy authentication workbook referenced in the documentation.

If unexpected blocks occur (for example, due to authentication flow policies or token protection), select a blocked sign-in in the sign-in logs and review the Conditional Access tab in the Activity details: sign-ins pane to see exactly which policy enforced the block and why.

References: