CISA.MS.AAD.1.1 - Legacy authentication SHALL be blocked.

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

Legacy authentication SHALL be blocked.

Rationale: The security risk of allowing legacy authentication protocols is they do not support MFA. Blocking legacy protocols reduces the impact of user credential theft.

Remediation action:

Follow the guide below to create a Conditional Access policy that blocks legacy authentication.

• Block legacy authentication - Microsoft Learn

Related links

• CISA Legacy Authentication - MS.AAD.1.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.1.1
Severity	High
Suite	CISA
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1110 Brute Force, T1078.004 Cloud Accounts
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.1.1
Criticality	SHALL
Upstream requirement	MS.AAD.1.1v1
Supports controls	cisa-scuba:MS.AAD.1.1, nist-800-53-r5:CM-7
PowerShell test	Test-MtCisaBlockLegacyAuth
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.1.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.1.1.md