{"id":347502,"date":"2025-06-18T10:50:41","date_gmt":"2025-06-18T17:50:41","guid":{"rendered":"https:\/\/msftnewsnow.com\/?p=347502"},"modified":"2025-06-27T19:49:15","modified_gmt":"2025-06-28T02:49:15","slug":"microsoft-365-security-legacy-authentication-block","status":"publish","type":"post","link":"https:\/\/msftnewsnow.com\/microsoft-365-security-legacy-authentication-block\/","title":{"rendered":"Microsoft 365 Security: Legacy Authentication Blocked by Default \u2013 What You Need to Know Now"},"content":{"rendered":"
\n
\n

Microsoft has announced that starting in mid-July 2025, all Microsoft 365<\/a> tenants will automatically block access to SharePoint, OneDrive, and Office files via legacy authentication protocols by default.<\/span> As reported by Bleeping Computer<\/em><\/a>, this sweeping change is set to roll out across Microsoft Entra, Microsoft 365 apps, SharePoint Online, and Microsoft OneDrive, with no additional licensing required. The update is expected to be fully implemented by August 2025.<\/p>\n

The Microsoft 365 Security Legacy Authentication Change<\/strong><\/h2>\n

\"Microsoft<\/p>\n<\/div>\n

Legacy authentication protocols\u2014such as RPS (Relying Party Suite) for SharePoint and OneDrive, and FPRPC (FrontPage Remote Procedure Call) for Office file opens\u2014have long been considered a significant vulnerability in enterprise security frameworks. These older authentication methods lack the robust protections provided by modern authentication, such as multi-factor authentication (MFA), and are frequently targeted by cybercriminals for brute-force and phishing attacks<\/span>.<\/span><\/p>\n

\n

Microsoft\u2019s decision to block these protocols by default is part of a broader initiative to protect organizations from evolving cyber threats. According to Microsoft\u2019s own analysis, more than 99% of password spray attacks and over 97% of credential stuffing attacks against Microsoft Entra ID use legacy authentication protocols.<\/span> By phasing out these outdated methods, Microsoft aims to close a major security gap.<\/p>\n

Who Is Affected?<\/strong><\/h2>\n

The change will impact all Microsoft 365 tenants, regardless of size or industry. Organizations that rely on SharePoint, OneDrive, or Office files accessed via legacy authentication methods will need to transition to modern authentication protocols. This includes users accessing files through older web browsers or applications that are not updated to support modern authentication standards.<\/span><\/p>\n

Microsoft has clarified that no additional licensing is required for this update. The security defaults will be enabled automatically, ensuring that all tenants benefit from the enhanced protection.<\/p>\n

Why Is Microsoft Making This Change?<\/strong><\/h2>\n

Legacy authentication protocols are inherently less secure than their modern counterparts. They do not support advanced security features like MFA, and they often transmit credentials in clear text, making them easy targets for interception and misuse.<\/span> Cybercriminals exploit these weaknesses to gain unauthorized access to sensitive data, posing a significant risk to organizations of all sizes.<\/p>\n

Microsoft\u2019s announcement emphasizes that blocking legacy authentication is a critical step in reducing the attack surface for Microsoft 365 environments. By enforcing modern authentication, organizations can better protect their data from unauthorized access and minimize the risk of data breaches.<\/span><\/p>\n

What Are the Technical Details?<\/strong><\/h2>\n

The rollout will begin in mid-July 2025 and is expected to be completed by August 2025. The update will block legacy browser authentication to SharePoint and OneDrive using RPS, as well as FPRPC for Office file opens. This means that any application or service still relying on these legacy protocols will no longer be able to access Microsoft 365 resources unless they are updated to support modern authentication.<\/span><\/p>\n

Microsoft has also stated that the change will address application access permissions that can expose organizations to unnecessary security risks. By updating security defaults, Microsoft is ensuring that only applications and services using secure, modern authentication methods can access sensitive data.<\/p>\n

How to Prepare for the Change<\/strong><\/h2>\n

\"Microsoft<\/p>\n

Organizations should take proactive steps to ensure a smooth transition:<\/p>\n