Mid-market financial services · 2,400 seats
Shutting down legacy authentication without breaking the business
Decommissioning Basic Auth and IMAP/SMTP without locking out the long tail of legacy mailbox clients and line-of-business scripts.
Problem
An Entra ID tenant inherited from years of organic growth still permitted legacy authentication. Sign-in logs showed roughly 12% of daily authentications using non-modern protocols, mostly from shared mailboxes, scanners and a handful of finance integrations.
Audit pressure required a hard cutoff in 60 days. A blanket Conditional Access block was the obvious move and the riskiest one — nobody had inventory of which scripts and devices were still using these protocols.
Solution
Enabled the legacy authentication block policy in report-only mode and exported sign-in logs daily into Log Analytics for two weeks. This produced a definitive list of every user, device and IP still using basic auth.
Triaged the list into three buckets: replaceable (move to modern auth), retire (decommission the workflow), and exception (issue a temporary service principal with explicit IP restriction).
Worked the buckets in parallel. The exception bucket was kept small and time-bound — each entry had a removal date written into the ticket from day one.
Outcome
Legacy authentication enforced and blocked across the tenant on day 41, ahead of the audit deadline.
Zero unplanned outages from the cutover; two known service principals were rotated to certificate auth during the change window.
Decision log and exception register handed to the audit team as evidence of a controlled change.