Microsoft 365 Authentication Hardening
Blocking legacy and high-risk authentication flows that bypass modern security controls. Four Conditional Access policies that shrink your identity attack surface by closing the sign-in paths attackers most often abuse.
Overview
What this baseline does
This Conditional Access baseline shrinks your identity attack surface by blocking the authentication paths attackers most often abuse. It disables:
Sign-ins from unsupported platforms
Legacy authentication protocols
Device code flow
Authentication transfer flow
Together these controls defend against phishing, adversary-in-the-middle (AiTM) and token-theft attacks.
Threats mitigated
Credential phishing
Stolen passwords on platforms with no modern protection.
Adversary-in-the-Middle
Token interception via fake login proxies.
Token theft & replay
Stolen session tokens reused from another device.
Device code phishing
Tricking users into pasting attacker codes.
Cross-device hijacking
Abuse of QR-code style sign-in transfers.
The four Conditional Access policies
Each policy is a single block rule in your Microsoft 365 tenant. Together they close the sign-in paths that cannot enforce MFA or that attackers routinely socially engineer.
Unsupported Platforms
Core - Block - Unsupported Platforms
Blocks any sign-in originating from a device type other than Windows, macOS, iOS or Android.
Legacy Authentication
Core - Block - Legacy Authentication
Blocks legacy protocols (e.g. POP, IMAP, basic auth, older Exchange ActiveSync) that cannot enforce MFA.
Device Code Flow
Core - Block - Device code flow
Blocks the OAuth device-code authentication flow most commonly abused in targeted phishing campaigns.
Authentication Transfer
Core - Block - Authentication Transfer flow
Blocks cross-device sign-in transfer (QR / ‘sign in on another device’) which can be misused by attackers.
Policy 01
Block - Unsupported Platforms
If it isn’t Windows, macOS, iOS or Android, it doesn’t sign in.
What it does
Applies to all users and all cloud apps. Blocks any sign-in attempt that does NOT come from one of the four supported platforms - Android, iOS, macOS or Windows.
Why it matters
Sign-ins from Linux, Chrome OS, gaming consoles and unidentified user agents are common indicators of automated attacks, scraping bots and adversary tooling.
Policy configuration
Core - Block - Unsupported Platforms
Policy 02
Block - Legacy Authentication
Stops protocols that cannot enforce modern MFA or Conditional Access.
What it does
Blocks any sign-in using legacy client app types - older Exchange ActiveSync clients and any ‘other clients’ category (POP, IMAP, SMTP AUTH, basic auth and older Office clients).
Why it matters
Legacy authentication is the single most common avenue for credential stuffing and password spray attacks because it bypasses MFA entirely.
Policy configuration
Core - Block - Legacy Authentication
Policy 03
Block - Device Code Flow
Closes one of the most common AiTM and phishing attack paths.
What it does
Blocks the OAuth 2.0 device-code grant for all users and all cloud apps. Device code flow is designed for input-limited devices but is rarely needed in everyday use.
Why it matters
Attackers initiate a device-code request and trick a victim into entering the code at microsoft.com/devicelogin - silently authorising the attacker’s session.
Policy configuration
Core - Block - Device code flow
Policy 04
Block - Authentication Transfer Flow
Prevents cross-device sign-in handoffs being abused by attackers.
What it does
Blocks the authentication-transfer flow used for ‘sign in on another device’ style hand-offs (e.g. QR-code login from desktop to mobile).
Why it matters
Authentication transfer can be socially engineered the same way device code flow is. Removing it stops a growing class of cross-device phishing attacks.
Policy configuration
Core - Block - Authentication Transfer flow
Report-only first
Nothing is enforced until you have seen what it would block.
How we deploy
A measured, low-risk rollout
Created in disabled state
All four policies are deployed to your tenant in a disabled state so nothing changes immediately.
Report-only validation
Each policy is enabled in report-only mode so we can see what it WOULD have blocked.
Sign-in log review
We review impacted sign-ins with you and identify any business systems that need an exclusion.
Switch to enforcement
Once we are happy with the report, each policy is moved from report-only to fully enabled.
What to check before enabling
Worth flagging: a few common systems still rely on the flows this baseline blocks. We identify them during report-only validation and agree any exclusions with you before enforcement.
Older multi-function printers
Scan-to-email devices using POP/IMAP/SMTP will need to be moved to modern auth or app passwords retired.
Line-of-business apps
Any internal app still using basic authentication will need updating before legacy auth is fully blocked.
Microsoft Teams Rooms / kiosks
Some shared-device sign-in journeys rely on device code flow - confirm any required exclusions.
Service accounts
Migrate to managed identities or workload identities; do not exempt admin accounts from these policies.
Ready to lock down identity?
Three steps take you from report-only findings to four enforced Conditional Access policies.
Step 01
Review
Walk through report-only sign-in findings.
Step 02
Exclude
Agree any required service-account or device exclusions.
Step 03
Enable
Switch each policy from report-only to enforcement.