Microsoft is closing the old login methods that attackers love most — and in 2026 that change will quietly break some of the everyday apps still using them, unless you find them first.
Sometime this year, an old scanner or accounting plugin in your office is going to stop logging in — and that's Microsoft deliberately shutting a door attackers love. There won't be a dramatic outage or a red warning. One morning the scan-to-email just fails, or a mailbox connector stops syncing, and nobody can say why. The cause is a run of identity changes Microsoft has announced for 2026 across Entra ID (the part of Microsoft 365 that handles sign-ins). The good news: this is genuinely good security being switched on for you. The catch: if you don't get ahead of it, you find out the hard way.
What is Microsoft changing with legacy authentication in 2026?
Microsoft is retiring legacy authentication across Microsoft 365 and Entra ID — the old sign-ins that send a username and password with no multi-factor authentication — so anything still relying on them will eventually stop working. The firmest date so far: Exchange Online's SMTP AUTH Basic Auth, which many office copiers still use to email scans, will be disabled by default for existing tenants at the end of December 2026, according to Microsoft's Message Center notice MC786329. Key IT finds and fixes those old sign-ins for Melbourne businesses before the switch flips.
Following the September 2025 deprecation of its old per-protocol MFA and self-service password reset policies, Microsoft has announced a sequence of identity changes rolling out through 2026. The exact dates have moved before and may move again, so treat these as a direction of travel rather than a calendar — and check Microsoft's own Entra and Message Center roadmap for the live dates at the time of writing.
Legacy authentication disablement
Older sign-in methods that can't do modern multi-factor authentication are being switched off by default across tenants.
Basic Authentication retirement
The remaining places where a username and password are sent straight to a service — with no MFA in between — are being retired, including legacy mail protocols still used by some devices and add-ins.
MFA enforcement for admins and sign-ins
Microsoft is forcing multi-factor authentication on administrator and portal access, and broadening enforcement from there.
Continuous Access Evaluation (CAE)
Access tokens get re-checked closer to real time, so a revoked or risky session is cut off faster instead of staying valid for an hour.
Why is Microsoft disabling legacy authentication?
Because legacy authentication can't enforce MFA, it's the open back door behind most password-based attacks. Based on its own analysis, Microsoft's guidance states that more than 99% of password-spray attacks and more than 97% of credential-stuffing attacks use legacy authentication protocols. An attacker can throw thousands of stolen or guessed passwords at an old login endpoint and, if just one matches, walk straight in — and because the tooling is automated, no business is too small to be a target. Close that endpoint and the same attack simply has nowhere to land. So while this change is being forced on you, it removes one of the single biggest causes of account takeover for small and medium businesses. It maps directly to the identity controls in the Essential Eight, which is the baseline we hold Melbourne businesses to. Credential stuffing runs on passwords leaked from other sites, and a free dark web scan shows which of your business email addresses have already turned up in known breaches.
What stops working when legacy authentication is switched off?
Mostly the things nobody looks at: scan-to-email on older copiers, accounting plugins, mailbox connectors, shared service accounts and old handsets — not your staff's Outlook, because current Microsoft 365 apps already use modern authentication. These half-forgotten items are wired into your mailboxes and identity, and like other forgotten devices on your network, they slip out of view until they fail.
Multifunction printers and scanners
The scan-to-email feature on older copiers often authenticates the old way, so scanning to a Microsoft 365 mailbox can stop.
Line-of-business and accounting plugins
Add-ins that send invoices, statements or reports through your mailbox may rely on Basic Auth under the hood.
Mailbox and CRM connectors
Older integrations that sync mail, contacts or calendars between systems can lose their connection.
Shared service accounts
The generic accounts used for alerts, monitoring or automated mail-outs are frequent offenders, because they were set up once years ago and never revisited.
Legacy phones and bespoke apps
Old handsets and in-house tools that were never updated to modern authentication.
How do you disable legacy authentication without an outage?
Find every legacy sign-in in your Entra ID logs, fix or replace each one, then block legacy sign-ins for a small pilot group before extending the block to everyone. That turns the change into a planned switch you control, not a surprise on a Monday. The work isn't complicated, but it has to be thorough, because one missed device is all it takes to break something.
Find what's still using legacy auth
Entra ID's sign-in logs show exactly which accounts and apps authenticate the old way. That report is the map for everything else.
Trace each one back to a device or app
Match every legacy sign-in to a real printer, plugin or service account, so nothing gets switched off blind.
Update, reconfigure or replace
Most devices and apps have a modern-authentication setting or a firmware update; a few genuinely old ones need replacing or a supported workaround.
Roll out MFA properly
Enforce multi-factor authentication on every account — especially admins and service accounts — using Conditional Access so it's consistent rather than per-app guesswork.
Test before the deadline, not after
Run a Conditional Access policy that blocks legacy authentication in report-only mode first, so you can see exactly who it would affect. Then switch it on for a pilot group, confirm everything still works, and expand. That way the cutover is a non-event.
This is core Microsoft 365 management and identity work, and it's the kind of change that's far easier with someone watching the logs day to day rather than discovering the problem from a frustrated staff member.
Blocking legacy authentication won't stop every attack that gets past MFA. Device code phishing abuses a genuine Microsoft sign-in feature: a lure gets someone to type an attacker's short code into Microsoft's real device sign-in page and complete their usual MFA, which approves the attacker's own device. The fix uses the same test-first method: a Conditional Access policy that blocks the device code flow, run in report-only mode first, with narrow exceptions for genuine devices such as Teams Rooms.
Where Key IT fits
For the businesses we look after, this is something we handle as routine identity hygiene rather than a fire drill. We pull the Entra ID sign-in reports, build the inventory of what's still on legacy auth, and work through it device by device so the door closes cleanly. 24/7 SOC monitoring watches identity signals continuously, so the same password-spray attempts these changes are designed to stop are also being spotted as they happen. And because one provider is accountable for both your help desk and your security, when a scanner does need reconfiguring, it's one phone call — not a ticket bounced between vendors. Since 2019, with no lock-in contract, that's the kind of change we'd rather do quietly in advance than clean up afterwards.
Frequently asked questions
What is legacy authentication, in plain English?
It's any older sign-in method that sends your username and password straight to a service without the ability to add multi-factor authentication in front of it. Because there's no second check, it's the method most password-guessing attacks rely on — which is why Microsoft is switching it off. Modern authentication replaces it with a token-based sign-in that supports MFA and Conditional Access.
Will this break Outlook or Teams for my staff?
No. Current versions of Outlook, Teams and the Microsoft 365 apps already use modern authentication. The risk sits with older, behind-the-scenes connections — multifunction scanners, accounting plugins, mailbox connectors and service accounts — that were set up years ago and still authenticate the old way. Those are what to find and fix before the cutover.
When does Microsoft switch off legacy authentication?
The firmest date is for Exchange Online's SMTP AUTH Basic Auth: Microsoft's notice MC786329 says it goes off by default for existing tenants at the end of December 2026. Admins can switch it back on for now, and Microsoft will announce a final removal date in the second half of 2027. Dates have moved before, so fix legacy sign-ins now.
What happens to scan-to-email when Basic Auth is switched off?
If a copier emails scans using SMTP AUTH and a saved password, the scans stop arriving: Exchange Online rejects the sign-in with error 550 5.7.30 (Basic authentication is not supported for Client Submission). The fix is moving the device to OAuth if its firmware supports it, or sending through an SMTP relay connector. Some older models need replacing.
Do I need Microsoft 365 Business Premium to block legacy authentication?
Not necessarily. Conditional Access, the flexible way to block legacy authentication, needs Entra ID P1, which comes with Business Premium. On Business Basic or Standard, you can turn on security defaults instead: they shut out legacy sign-ins and make every user set up MFA. Less flexible, but a big step up from leaving the door open.
Is legacy authentication the same as Basic Auth?
Almost. Basic Auth means sending a username and password with every request, and it's how the older sign-in protocols work: POP, IMAP, SMTP AUTH, older Exchange ActiveSync connections and Office 2010-era clients. Legacy authentication is Microsoft's umbrella term for those protocols, none of which can do MFA. Modern authentication replaces them with token-based sign-in.
How do I find out if anything in my business is affected?
Your Entra ID sign-in logs will show which accounts and apps are still authenticating the old way. Reviewing that report, then tracing each result back to a real device or plugin, tells you exactly what needs attention. If you'd like that done for you, a quick review of your tenant will surface the lot.
What if an attacker has already signed in through an old login?
Treat it as a compromised account. From a clean device, block sign-in, reset the password, sign the account out of every session, and remove any MFA methods, app passwords and inbox or forwarding rules you don't recognise. App passwords survive a password reset, so delete them. Our first-hour checklist for a hacked Microsoft 365 account walks through each step and who to tell in Australia.
Are your staff's logins already exposed? A free dark web scan checks your business email domain against known breaches.
Request the Free Scan