After our recent migration to Microsoft Entra ID (formerly Azure AD), I've been conducting a comprehensive audit of authentication methods to ensure baseline security postures are met. A primary concern was the continued use of legacy authentication protocols (like IMAP, POP3, SMTP, ActiveSync with basic auth), as they are a significant attack vector, bypassing multi-factor authentication and conditional access policies. While Microsoft has been pushing to disable these protocols, I suspected there might be lingering exceptions or users with specific license assignments allowing it.
To systematically identify these users, I developed a PowerShell script that queries the Entra ID sign-in logs via Microsoft Graph API. The script filters for successful sign-ins using client apps known to leverage legacy authentication, then aggregates the data to provide a clear list of affected user principals. The results were, frankly, alarming. Out of a pilot group of ~500 users, 47 had authenticated using a legacy protocol within the last 30 days. This represents a 9.4% exposure rate, which is unacceptably high for our stated security goals.
The core of the script utilizes the `Get-MgAuditLogSignIn` cmdlet from the Microsoft Graph PowerShell SDK, filtering on the `clientAppUsed` property. Here is the essential query structure:
```powershell
# Connect to Graph with appropriate scopes (AuditLog.Read.All, User.Read.All)
Connect-MgGraph -Scopes "AuditLog.Read.All", "User.Read.All"
# Define the date range
$startDate = (Get-Date).AddDays(-30).ToString("yyyy-MM-dd")
# Fetch sign-ins where legacy auth clients were used
$legacySignIns = Get-MgAuditLogSignIn -Filter "clientAppUsed eq 'exchangeActiveSync' or clientAppUsed eq 'outlookService' or clientAppUsed eq 'imap' or clientAppUsed eq 'pop3' or clientAppUsed eq 'smtp' or clientAppUsed eq 'authenticatedSmtp'" -All
# Group by user to get unique accounts
$affectedUsers = $legacySignIns | Group-Object -Property UserId | ForEach-Object {
$user = Get-MgUser -UserId $_.Name
[PSCustomObject]@{
UserPrincipalName = $user.UserPrincipalName
DisplayName = $user.DisplayName
LastLegacySignIn = ($_.Group | Sort-Object CreatedDateTime -Descending | Select-Object -First 1).CreatedDateTime
LegacyClientTypes = ($_.Group.clientAppUsed | Sort-Object -Unique) -join ', '
SignInCount = $_.Count
}
}
# Export results
$affectedUsers | Export-Csv -Path "LegacyAuthUsers.csv" -NoTypeInformation
```
Key findings from the output data, presented in a summary table:
| Metric | Count | Percentage (of pilot group) |
| :--- | :--- | :--- |
| Total Users in Scope | 500 | 100% |
| Users with Legacy Auth | 47 | 9.4% |
| Top Client Type | Exchange ActiveSync | (68% of cases) |
| Users with >5 legacy sign-ins | 12 | 2.4% |
The breakdown by client type was particularly insightful. The prevalence of Exchange ActiveSync suggests many mobile devices are using basic authentication, likely configured before our migration. This creates a substantial risk surface, as these devices are outside the purview of our conditional access policies requiring compliant devices.
Next steps involve a cohort analysis to see if these users share common attributes (e.g., specific departments, license types, or device platforms) and then a targeted communication and remediation campaign. I strongly recommend running a similar audit in your own environments. The script's parameters, such as the date range and filtered client apps, can be adjusted to suit your audit period and focus.
— Amanda
Data > opinions