Blocking Legacy Authentication Without Breaking Clinical Devices
Northwind Health has 2,800 mailboxes in a hybrid deployment. Conditional Access already requires MFA for 25 administrators, but all other users sign in with only a password. The security team wants to block legacy authentication within 30 days after a password-spray incident. About 300 users still run Outlook 2013 on Windows 10, 40 multifunction printers send scan-to-email using SMTP AUTH with three shared service accounts, and a clinical application uses IMAP to read a shared mailbox. The domain publishes DMARC p=none; executives receive spoofed messages from a lookalike domain. A pilot block of legacy clients caused repeated credential prompts for 60 Outlook 2013 users and stopped all 40 printers. The CIO wants no disruption to clinical staff. No device management is in place.
1. Sequence the controls you would deploy to block legacy authentication with minimal disruption, and state whether Security Defaults should be enabled. Justify each step.
Read the worked answer
Security Defaults should not be enabled: it conflicts with the existing Conditional Access policies and would force MFA on all users at once, including shared clinical accounts.
Sequence:
- Create a break-glass account excluded from Conditional Access and confirm it works.
- Build a 'Block legacy authentication' Conditional Access policy in report-only mode and use Entra sign-in logs to inventory client apps and protocols for two to four weeks.
- Separate the workloads that use basic auth: Outlook 2013, SMTP AUTH printers, and the IMAP application. Remediate them before enforcement.
- Pilot the block on a ring of 100 users, then expand.
For Outlook 2013, the repeated prompts are the expected result of blocking basic auth. The fix is upgrading to Outlook 2016 or later or Microsoft 365 Apps, not permanent exclusion. For printers and IMAP, the block will break them because SMTP AUTH and IMAP use legacy auth; the Conditional Access policy alone does not solve those. Treat the legacy-auth block and protocol disablement as two projects: Conditional Access blocks interactive legacy clients, while tenant-level SMTP AUTH and IMAP controls handle service accounts. The 30-day deadline is feasible only if the 300 Outlook 2013 seats are upgraded first.
2. Design the SMTP AUTH configuration for the 40 printers so that one compromised printer cannot send as any employee or relay spam to the internet.
Read the worked answer
Do not use three shared service accounts. Create a separate Exchange Online mailbox for each printer, or at minimum one per site, and enable SMTP AUTH only on those mailboxes while the tenant default remains disabled. Use unique long passwords stored in the device, and do not grant Send As or Full Access to any employee.
Because Exchange Online cannot scope SMTP AUTH by source IP, containment must come from mailbox design and mail flow. Give each printer mailbox only the permissions it needs, add a transport rule that blocks messages from these senders to external domains except an approved list, and add a second rule that redirects them for review if volume spikes. Configure SPF to include the sending path and enable DKIM for the domain. Monitor with Defender for Office 365 and alert on outbound volume per printer mailbox.
A compromised single-purpose mailbox then cannot send as an employee, cannot read other mailboxes, and cannot relay broadly. The shared accounts are the real risk: they prevent attribution and let one credential compromise every device.
3. The lookalike domain spoofs executives. Outline a DMARC enforcement plan that reaches p=reject without blocking legitimate bulk mail.
Read the worked answer
DMARC protects your own domain, not the lookalike domain, so separate the two problems.
For contoso.com, collect aggregate reports (rua) for two to four weeks, inventory every legitimate sender (Microsoft 365, the application relay, bulk mail vendors) and confirm SPF or DKIM alignment for each. Then move in stages: p=none with pct=100 and reporting, p=quarantine pct=10, 50, 100, then p=reject. Keep a subdomain policy and monitor.
For the lookalike domain, DMARC will never block it. Use Defender for Office 365 anti-phishing impersonation protection, a transport rule that blocks the lookalike domain and similar display names, and user reporting.
The judgement call is not to jump to p=reject while the clinical application and printers still send unauthenticated mail, because that would quarantine legitimate messages. Use the aggregate reports to find those sources before enforcement.