Policies/NSP-BASE-LEGACY-01.psd1
|
@{ Id = 'NSP-BASE-LEGACY-01' Name = 'Block legacy authentication' Version = 1 Description = 'Blocks Exchange ActiveSync and other legacy clients (basic authentication: POP, IMAP, SMTP AUTH, older Office). They cannot do MFA, so every MFA policy is bypassed through them.' Notes = 'New with the module (2026-10-09), from the common baselines (Microsoft, CIS, capolicies.com). A device or app that still sends mail with basic authentication (a scanner, a line-of-business app) needs its account in the service accounts, or an exclusion on this policy. Report-only first shows who still uses legacy clients.' LegacyNames = @('Block legacy authentication', 'CIS - Block legacy authentication') DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ Include = @('All') } ClientAppTypes = @('exchangeActiveSync', 'other') Grant = @{ Operator = 'OR' BuiltInControls = @('block') } } |