CIS.M365.7.2.1 - (L1) Ensure modern authentication for SharePoint applications is required
Overview
SharePoint Online can accept sign-ins from legacy authentication protocols. Those protocols do not support multifactor authentication or conditional access, so anyone who obtains or sprays a password can reach SharePoint content without a second factor.
Blocking legacy protocols makes SharePoint sign-in use modern authentication only. Older clients and scripts that depend on basic authentication stop working until they are updated. A Conditional Access policy that blocks legacy authentication is the main control across Microsoft 365, so this SharePoint setting is a second layer that closes the same route in SharePoint itself.
Current service behavior: Microsoft permanently retired the legacy IDCRL authentication protocol for SharePoint Online and OneDrive on May 1, 2026. This test still audits the SharePoint tenant setting required by CIS, but it does not inspect client traffic. Migrate any affected clients, scripts, or applications to OpenID Connect or OAuth; the retired protocol can no longer be re-enabled.
Remediation action
- Sign in to the SharePoint admin center.
- Go to Policies > Access control.
- Under Apps that don't use modern authentication, select Block access.
- Select Save.
To apply the same setting with PowerShell, connect with Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive and run:
Set-PnPTenant -LegacyAuthProtocolsEnabled $false
Related links
- SharePoint admin center
- Set-PnPTenant
- Block legacy authentication
- Retirement of IDCRL authentication in SharePoint Online (MC1184649)
- Migrating from IDCRL authentication to modern authentication
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.7.2.1 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Feature | Access control |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:7.2.1, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCisSpoModernAuthentication |
| Services | SharePointOnline |
Source
- Test:
tests/cis/Test.CIS.M365.7.2.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.7.2.1.md