Detecting Connections Affected By The Blocking Legacy Authentication Enforcement Expected By July 2025
Query
EntraIdSignInEvents
| where ErrorCode == "0"
| where Timestamp > ago(7d)
| where ClientAppUsed in ("Exchange ActiveSync", "Exchange Web Services", "AutoDiscover", "Unknown", "POP3", "IMAP4", "Other clients", "Authenticated SMTP", "MAPI Over HTTP", "Offline Address Book")
or UserAgent in("BAV2ROPC", "CBAinPROD", "CBAinTAR", "MSRPC")
| summarize by AccountDisplayName, IPAddress, AccountUpn, ClientAppUsed, UserAgentAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1078.004 | Valid Accounts: Cloud Accounts |
Author: Sergio Albea (23/06/2025)
Detecting connections affected by the Blocking Legacy Authentication enforcement expected by July 2025
Beginning in July, access to services like SharePoint, OneDrive, and Office files using outdated authentication methods—such as RPS and FPRPC—will be blocked, with full implementation expected by August. This change is part of Microsoft’s broader strategy under the Secure Future Initiative (SFI), which promotes a “Secure by Default” approach to help organizations maintain a strong baseline of protection. The following KQL queries will help you to detect remaining connections using the legacy authentication methods
Explanation
This query is designed to identify and summarize connections to cloud services that are still using outdated or "legacy" authentication methods. These methods are set to be blocked by Microsoft starting in July 2025 as part of their Secure Future Initiative, which aims to enhance security by enforcing modern authentication standards.
Here's a breakdown of what the query does:
-
Data Source: It pulls data from
EntraIdSignInEvents, which logs sign-in events. -
Error Code Filtering: It filters for events with an
ErrorCodeof "0", indicating successful sign-ins. -
Time Frame: It looks at events from the past 7 days.
-
Legacy Authentication Detection: It checks if the sign-ins used specific legacy client applications or user agents that are known for using outdated authentication methods. These include:
- Client applications like "Exchange ActiveSync", "Exchange Web Services", "POP3", "IMAP4", etc.
- User agents such as "BAV2ROPC", "CBAinPROD", etc.
-
Summarization: It summarizes the data by listing the account display name, IP address, account UPN (User Principal Name), client application used, and user agent.
This query helps organizations identify which accounts are still using legacy authentication methods so they can take action to update these methods before they are blocked, ensuring continued access and compliance with Microsoft's security policies.
