Microsoft 365: PowerShell – How to Block legacy browser authentication to SharePoint and OneDrive

Hi All,

Greetings for the day!!!

Today, I am sharing PowerShell CMDLET for blocking legacy browser authentication to SharePoint and OneDrive using RPS.

Details

• Microsoft recommends that we should block authentication requests using legacy protocols that don’t support multifactor authentication.
• Based on Microsoft’s analysis
  • more than 97 percent of credential stuffing attacks use legacy authentication
  • more than 99 percent of password spray attacks use legacy authentication protocols
• These attacks would stop with basic authentication disabled or blocked
• Customers without licenses can make use of security defaults to block legacy authentication.
• We have detailed article on “Security Default“. Azure – Preparing exam SC – 300 – Identity and Access Administrator – security defaults – Part 5 – https://knowledge-junction.in/2021/03/19/preparing-exam-sc-300-identity-and-access-administrator-security-defaults-part-5/

How to get whether Legacy browser authentication is enabled in my tenant

• We will use “Get-SPOTenant” PowerShell CMDLET “
• Once we get all the tenant settings using “Get-SPOTenant“, we will use “LegacyAuthProtocolsEnabled” property, which will return either “True” or “False“
• Return value will show whether legacy browser authentication is enabled or disabled in my tenant
• Connect to our tenant using Connect-SPOService PowerShell CMDLET

PS C:\> Get-Module -Name Microsoft.Online.SharePoint.PowerShell -ListAvailable

    Directory: C:\Users\u1086350\Documents\PowerShell\Modules

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Binary     16.0.2612…            Microsoft.Online.SharePoint.PowerS… Desk

PS C:\> import-Module -Name  C:\Users\u1086350\Documents\PowerShell\Modules\Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

PS C:\> Connect-sPOService -Url https://knowledgejunction1-admin.sharepoint.com/ -Credential $cred

PS C:\> $TenantSettings = Get-SPOTenant

PS C:\> $TenantSettings.LegacyAuthProtocolsEnabled
True

PS C:\> $TenantSettings.LegacyBrowserAuthProtocolsEnabled
True

• Once we connected to our tenant, next step is to get the tenant settings using Get-SPOTenant

We have detailed article to get the Microsoft 365 tenant setting. Microsoft 365: PowerShell – How to retrieve tenant settings – https://knowledge-junction.in/2025/06/22/m365-powershell-retrieve-tenant-settings/

Next step is to update the setting to Block legacy browser authentication setting for SharePoint and OneDrive using Set-SPOTenant

REFERENCES

• Security defaults in Microsoft Entra ID – https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
• Azure – Preparing exam SC – 300 – Identity and Access Administrator – security defaults – Part 5 – https://knowledge-junction.in/2021/03/19/preparing-exam-sc-300-identity-and-access-administrator-security-defaults-part-5/

Thanks for reading 🙂

Keep reading, share your thoughts, experiences. Feel free to contact us to discuss more. If you have any suggestion / feedback / doubt, you are most welcome.