Legacy Protocols & SMTP AUTH Exposure

The question it answers: Which mailboxes use SMTP AUTH or other legacy protocols, and which have them switched on for no reason?

Microsoft disables Basic authentication for SMTP AUTH client submission by default for existing tenants at the end of December 2026 (admins can re-enable it for now; a final removal date follows in 2027). Printers, scanners and scripts that send mail with a username and password will stop. This lists which mailboxes actually use SMTP AUTH and other legacy protocols, and which have them switched on for no reason.

Note

Timeline per Microsoft’s updated SMTP AUTH Basic authentication announcement - re-check it before planning. ‘Tenant default’ means the mailbox inherits Get-TransportConfig SmtpClientAuthenticationDisabled.

At a glance

Where in the app	Exchange Online › Mail Security Posture › Legacy Protocols & SMTP AUTH
Workload	Exchange Online
Kind	Table · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Microsoft Entra ID P1 for the sign-in columns.
Report id (API and MCP)	exchange.posture.legacy-protocols

Columns

Column	Key	Type
Mailbox	DisplayName	Text
Address	UserPrincipalName	Text
Finding	Finding	Status
SMTP AUTH	SmtpAuth	Text
Legacy sign-ins (7d)	LegacySignIns	Text
Protocols used	LegacyProtocolsUsed	Text
POP	PopEnabled	Text
IMAP	ImapEnabled	Text
Last legacy sign-in	LastLegacySignIn	Date

Filters

Filter	Key (API)	On when the page opens
Only mailboxes with a finding	findings	Yes

What it needs

Licence: Microsoft Entra ID P1 for the sign-in columns.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• Get-TransportConfig
• Get-CASMailbox -ResultSize Unlimited
• GET /beta/auditLogs/signIns (7 days, clientAppUsed)

Through the API and MCP

GET /ir-api/v1/reports/exchange.posture.legacy-protocols?size=100
GET /ir-api/v1/reports/exchange.posture.legacy-protocols?filter=findings

An AI assistant reads it with the MCP tool get_report and the id exchange.posture.legacy-protocols. The client needs the Read grant for Exchange Online. See Using the API.