Skip to main content
Version: 2.3.0

MT.1185 - Block legacy MSOnline (MSOL) PowerShell module

Jan BakkerJohn Flores
Contributed by Jan Bakker with John FloresAll contributors →

Overview​

Description​

Checks if the legacy MSOnline (MSOL) PowerShell module is blocked from authenticating to the tenant.

Why This Matters​

The MSOnline (MSOL) and Azure AD PowerShell modules were retired by Microsoft and no longer receive security updates. Because they predate modern authentication controls, requests made through them can be a weaker, less-monitored path into a tenant's identity administration than the current Microsoft Graph PowerShell SDK.

The blockMsolPowerShell setting on the tenant's authorization policy lets an admin explicitly block authentication requests from the legacy MSOnline PowerShell module's service principal. This isn't enabled by default for every tenant, so it needs to be checked explicitly rather than assumed to already be in place — leaving it unblocked keeps an unsupported and unmonitored administrative access path open.

Remediation action​

  1. Connect to Graph using Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization".
  2. Run the following PowerShell command to review the current value:
Get-MgPolicyAuthorizationPolicy | Select-Object BlockMsolPowerShell
  1. If BlockMsolPowerShell is $false, block the legacy MSOnline PowerShell module:
# This example uses the cmdlet syntax published in the Microsoft Learn documentation:
# https://learn.microsoft.com/powershell/module/microsoft.graph.identity.signins/update-mgpolicyauthorizationpolicy
$params = @{
    blockMsolPowerShell = $true
}
Update-MgPolicyAuthorizationPolicy -BodyParameter $params

Test Metadata​

FieldValue
Test IDMT.1185
SeverityHigh
SuiteMaester
CategoryEntra
PowerShell testTest-MtEntraMsolPowerShellBlocked
TagsEntra, Maester, MT.1185

Source​

  • Pester test: tests/Maester/Entra/Test-MtEntraMsolPowerShellBlocked.Tests.ps1
  • PowerShell source: powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.ps1