Entra ID: legacy authentication allowed and no location conditions on sign-in
- Where
- The Entra ID tenant: Conditional Access, named locations, the sign-in logs and the privileged roles.
- What we saw
- No Conditional Access policy blocks legacy authentication; the sign-in log shows basic-auth IMAP sign-ins in the last 30 days. No named locations are defined, so nothing limits sign-ins to the office and VPN addresses or to the countries staff work from, and the log shows successful user sign-ins from three countries where the organisation has no one. Four accounts hold Global Administrator permanently rather than through Privileged Identity Management.
- Reference
- Microsoft Entra Conditional Access (named locations, blocking legacy authentication), Microsoft’s mandatory MFA for the admin portals, Privileged Identity Management; the report cites the controls by name.
- Why it matters
- Microsoft now enforces MFA for the admin portals, so administrator MFA is not the gap. What stays open is the user sign-in surface: legacy protocols cannot complete MFA, so a reused password is enough to read mail, and without location conditions a stolen password works from anywhere in the world. Standing Global Administrators are still the accounts an attacker wants.
- Fix
- Create a Conditional Access policy that blocks legacy authentication, run it in report-only mode for a week, then enforce it. Define named locations for the office and VPN ranges and the countries staff work from, and block or step up sign-ins from outside them, with the break-glass accounts excluded. Reduce standing Global Administrators to two break-glass accounts and move the rest to eligible assignments in Privileged Identity Management.
- Order and effort
- Order 2 of 9. One to two days, spread over the report-only week.
Coop Security
