Skip to main content
Version: 3.0.0-preview

MT.1185 - Block legacy MSOnline (MSOL) PowerShell module.

Jan Bakker
Contributed by Jan BakkerAll contributors →

Overview​

Description​

Checks if the legacy MSOnline (MSOL) PowerShell module is blocked from authenticating to the tenant.

Why This Matters​

The MSOnline (MSOL) and Azure AD PowerShell modules were retired by Microsoft and no longer receive security updates. Because they predate modern authentication controls, requests made through them can be a weaker, less-monitored path into a tenant's identity administration than the current Microsoft Graph PowerShell SDK.

The blockMsolPowerShell setting on the tenant's authorization policy lets an admin explicitly block authentication requests from the legacy MSOnline PowerShell module's service principal. This isn't enabled by default for every tenant, so it needs to be checked explicitly rather than assumed to already be in place — leaving it unblocked keeps an unsupported and unmonitored administrative access path open.

Remediation action​

  1. Connect to Graph using Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization".
  2. Run the following PowerShell command to review the current value:
Get-MgPolicyAuthorizationPolicy | Select-Object BlockMsolPowerShell
  1. If BlockMsolPowerShell is $false, block the legacy MSOnline PowerShell module:
# This example uses the cmdlet syntax published in the Microsoft Learn documentation:
# https://learn.microsoft.com/powershell/module/microsoft.graph.identity.signins/update-mgpolicyauthorizationpolicy
$params = @{
    blockMsolPowerShell = $true
}
Update-MgPolicyAuthorizationPolicy -BodyParameter $params

Test Metadata​

FieldValue
Test IDMT.1185
SeverityMedium
SuiteMaester
ProductEntra ID
FeatureUser and directory settings
AreaAccess control
Resource typeTenant
User impactLow
Implementation costLow
MITRE ATT&CKT1059.009 Cloud API, T1078.004 Cloud Accounts
Supports controlsnist-800-53-r5:CM-7
PowerShell testTest-MtEntraMsolPowerShellBlocked
ServicesGraph

Source​