Why Legacy Auth Fuels Mass Password Spraying

Legacy IMAP, POP3, and basic-auth sign-in paths let attackers skip multi-factor authentication entirely, because those protocols predate MFA and many mail and identity systems still accept them by default. If any of these paths are open on your tenant, disable them this week. They're one of the most common ways a mass password-spraying campaign turns a handful of leaked passwords into a real breach.

Why legacy protocols skip MFA entirely

Modern sign-in flows (OAuth, modern authentication) can enforce a second factor and conditional access checks before granting access. IMAP, POP3, and basic auth were designed to send a username and password in one shot. There's no step where a challenge, push notification, or one-time code fits in.

So if legacy auth is still enabled anywhere on your tenant, an attacker who has your password doesn't need to defeat your MFA. They just walk in through a door that was never built to ask for it.

How mass password spraying scales through this gap

Attackers spraying passwords aren't guessing one account at a time. They take huge credential lists, usually assembled from unrelated breaches, and try a small number of common or reused passwords across thousands of accounts and domains.

They favour legacy auth endpoints for two reasons:

• In many environments, these endpoints receive less rate-limiting and less monitoring than modern sign-in flows, since security tooling and alerting have typically been built around OAuth and conditional access, not older protocols.

• A successful hit produces no MFA prompt, no push notification, no OTP request, so the account owner usually has no idea anything happened.

That gap means a spray campaign can succeed quietly against a slice of your organization's mailboxes without a single "approve this sign-in" alert ever firing.

Check this week: are you exposed right now?

Don't assume. Verify. Pulling and reviewing the right logs is a quick, well-scoped task for most IT teams, not a major project:

• Microsoft 365 / Entra ID: pull sign-in logs and filter by client app. Look for IMAP4, POP3, Authenticated SMTP, or "Other clients." Any hits mean legacy auth is live.

• Conditional access / Security Defaults: confirm a policy actually blocks legacy authentication. Having MFA enabled is not the same as blocking these protocols.

• Google Workspace: check whether any organizational unit still allows "less secure app access" or basic-auth IMAP/POP.

• On-prem Exchange or hybrid setups: legacy auth risk doesn't disappear just because you're not fully cloud-hosted. Check IIS/Exchange logs for IMAP4, POP3, and basic-auth SMTP AUTH entries, and confirm your hybrid connector isn't silently passing basic auth through to Exchange Online.

• Other mail or identity providers: if you're not on Microsoft 365 or Google Workspace, ask your provider directly whether IMAP/POP/basic-auth sign-in is enabled by default and how to view a log of it. The exposure exists across most mail platforms; the audit trail just looks different.

• No full admin log access? A lightweight check: try connecting to your own mailbox with an old-style email client using just a username and password. If it connects without any second-factor prompt, legacy auth is open on that account.

Decision rule: if legacy auth sign-ins show up anywhere in the last month of logs, treat it as active exposure, not a theoretical risk. Someone or something is using that door right now.

How to disable it without breaking the business

Legacy auth usually survives because IT teams worry about breaking an old scanner, a mail-merge tool, or a script nobody remembers writing. The phased rollout below avoids that problem, and most organizations can move through it in a matter of weeks rather than months:

• Inventory first (days, not weeks). Use your sign-in logs to identify which accounts and apps are actually using legacy auth today.

• Migrate what you can (roughly one to a few weeks). Move real users and supported apps to modern auth; for line-of-business tools, check for an updated connector or app-password option.

• Block in phases (staggered over the following weeks). Start with a conditional access policy that blocks legacy auth for standard users, then extend it to service and shared accounts once you've confirmed nothing breaks.

Decision rule: if you can't identify a legitimate business reason for a legacy-auth connection within a short investigation, block it. Re-enable only if something breaks and you can name the owner and the reason. The cost of a forgotten integration is far lower than the cost of leaving a standing MFA bypass open.

What if you can't fully disable it yet

Sometimes a vendor is slow, or a piece of hardware (an old scanner, a legacy CRM sync) genuinely can't speak modern auth yet. That's a real constraint, not an excuse to leave it wide open. If you're stuck:

• Restrict the legacy connection to a known IP range or location via conditional access, instead of leaving it open to the internet.

• Put it on a dedicated service account with a long, unique password, and monitor its sign-ins specifically.

• Set a hard retirement date. A temporary exception should have an end date attached to it, or it becomes permanent by default.

If you already suspect a spray has succeeded, unexplained sign-ins, forwarding rules you didn't set, mailbox rules that redirect finance emails, treat it as an active incident and get eyes on it fast. In one engagement with a venture-backed technology company, fast-growing and without a dedicated in-house security hire, we contained an active intrusion while also running a broader AWS and GCP cloud security review, application and infrastructure penetration testing, and virtual CISO leadership. See the full case study. If you're in a similar position, our incident response service is built for exactly this kind of situation.

Make this part of an ongoing routine, not a one-off fix

Legacy auth has a way of quietly re-appearing: a new integration, a re-enabled setting after a tenant migration, a forgotten exception nobody closed out. Treat identity configuration as something to review on a schedule, not a box you tick once. Our managed security service is built around exactly that kind of ongoing, fix-first program rather than a one-time audit.

For background on requiring multi-factor authentication and reducing identity-based attack paths, CISA maintains guidance worth bookmarking at CISA's MFA guidance.

Frequently asked questions

What is password spraying?

Password spraying is an attack technique where an attacker tries a small number of common or previously leaked passwords against a large number of accounts, rather than repeatedly guessing many passwords against one account. It's designed to avoid account lockouts while still finding the small percentage of accounts using weak or reused passwords.

Does turning on MFA automatically stop legacy auth attacks?

Not by itself. MFA has to be enforced on the sign-in path the attacker is using. Legacy IMAP, POP3, and basic-auth connections don't pass through the modern authentication flow, so they can bypass MFA entirely even when MFA is switched on for your organization. You need a separate policy that blocks legacy auth outright.

How do I know if legacy auth is actually being used in my environment?

Check your sign-in or authentication logs for the specific client app or protocol (IMAP4, POP3, Authenticated SMTP, "Other clients," or basic-auth entries in on-prem mail logs). If you don't have full admin log access, a simple test connection with an old-style mail client, as described above, will tell you quickly whether the door is open.

Is it safe to disable legacy auth for everyone at once?

It's safer to phase it: inventory first, migrate the accounts and apps you can identify, then block standard users before extending the block to service and shared accounts. That sequence surfaces the occasional forgotten integration before it becomes an outage, while still closing the gap in a matter of weeks.

If you want a fast, no-pressure look at whether legacy auth or other MFA gaps are open on your tenant right now, start with a free security review.