Detecting Connections Affected By The Blocking Legacy Authentication Enforcement Expected By July 2025
Query
AADSignInEventsBeta
| where ErrorCode == "0"
| where Timestamp > ago(7d)
| where ClientAppUsed in ("Exchange ActiveSync", "Exchange Web Services", "AutoDiscover", "Unknown", "POP3", "IMAP4", "Other clients", "Authenticated SMTP", "MAPI Over HTTP", "Offline Address Book")
or UserAgent in("BAV2ROPC", "CBAinPROD", "CBAinTAR", "MSRPC")
| summarize by AccountDisplayName, IPAddress, AccountUpn, ClientAppUsed, UserAgentAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1078.004 | Valid Accounts: Cloud Accounts |
Author: Sergio Albea (23/06/2025)
Detecting connections affected by the Blocking Legacy Authentication enforcement expected by July 2025
Beginning in July, access to services like SharePoint, OneDrive, and Office files using outdated authentication methods—such as RPS and FPRPC—will be blocked, with full implementation expected by August. This change is part of Microsoft’s broader strategy under the Secure Future Initiative (SFI), which promotes a “Secure by Default” approach to help organizations maintain a strong baseline of protection. The following KQL queries will help you to detect remaining connections using the legacy authentication methods
Explanation
This query is designed to help identify connections to Microsoft services that are still using outdated authentication methods, which will soon be blocked as part of Microsoft's security updates. Specifically, it looks at sign-in events from the past week (7 days) where the authentication was successful (ErrorCode "0") and checks if the client application or user agent used is one of the older, less secure methods. It then summarizes the results by displaying the account name, IP address, account UPN (User Principal Name), client application used, and user agent. This information can help organizations identify and update these connections to comply with the upcoming security changes.
