CISA.MS.AAD.1.1: Legacy authentication SHALL be blocked.
| ID | CISA.MS.AAD.1.1 |
| Severity | High |
| Suite | CISA SCuBA baselines |
| Product | Entra ID |
| Feature | Conditional Access |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.1.1 (SHALL) |
| Framework controls | cisa-scuba:MS.AAD.1.1nist-800-53-r5:CM-7 Least Functionality |
| MITRE ATT&CK | T1110, T1078.004 |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Legacy authentication SHALL be blocked.
Rationale: The security risk of allowing legacy authentication protocols is they do not support MFA. Blocking legacy protocols reduces the impact of user credential theft.
Remediation action:
Section titled “Remediation action:”Follow the guide below to create a Conditional Access policy that blocks legacy authentication.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill, andremieth. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.