Legacy authentication

Legacy authentication covers the sign-in protocols that carry only a username and a password and cannot ask for a second factor. In email that means IMAP, POP, authenticated SMTP and the older modes of Exchange ActiveSync; on the directory side, NTLM and applications that bind with simple LDAP. The flaw is built in: MFA (multi-factor authentication) turned on for the account does not apply when the session goes through one of them. Password spraying, a handful of common passwords tried against thousands of accounts, goes straight for these entry points. The attacker gets into a mailbox without ever seeing an MFA prompt, and wire fraud starts from there. Microsoft began switching off basic authentication in Exchange Online on October 1, 2022, after several delays. The issue did not go away with it. On-premises Exchange servers are still around, as are business apps that send mail over authenticated SMTP, multifunction copiers and directories still running NTLM. In the logs, what keeps these protocols open is usually some forgotten piece of equipment: a copier, a UPS sending its alerts, an old billing script. The cyber questionnaire asks two ways: head-on (is legacy authentication blocked?) and indirectly, when it asks whether MFA covers all access to email. A "yes" to the second with legacy protocols left open is a wrong answer, even given in good faith. The evidence sits in the conditional access policy that blocks legacy clients, or in sign-in logs filtered by client type. Underwriters increasingly ask for that screenshot instead of a ticked box.