TenantLens

1.3.2

Rules/SPO-002.legacy-auth-disabled.psd1

@{
    Id          = 'SPO-002'
    Title       = 'Legacy authentication protocols are disabled for SharePoint'
    Area        = 'SharePointSettings'
    Severity    = 'Medium'
    References  = @(
        'https://learn.microsoft.com/sharepoint/control-access-from-unmanaged-devices'
    )
    Rationale   = 'SharePoint legacy auth lets old Office clients authenticate without modern auth - bypassing Conditional Access and MFA on the document layer.'
    Remediation = 'Disable legacy authentication protocols in the SharePoint admin center (Set-SPOTenant -LegacyAuthProtocolsEnabled $false).'
    Test        = {
        param($Snapshot)
        $settings = $Snapshot.SharePointSettings
        if (-not $settings -or -not $settings.PSObject.Properties['isLegacyAuthProtocolsEnabled']) {
            return New-TLRuleResult -Status Manual -Evidence 'isLegacyAuthProtocolsEnabled not present in the snapshot.'
        }
        if ([bool]$settings.isLegacyAuthProtocolsEnabled) {
            New-TLRuleResult -Status Fail -Evidence 'Legacy authentication protocols are enabled for SharePoint.'
        }
        else {
            New-TLRuleResult -Status Pass -Evidence 'Legacy authentication protocols are disabled for SharePoint.'
        }
    }
}