Three PowerShell Scripts That Find Basic Auth in Every Tenant Before Microsoft Pulls It

Somewhere in your customer base there is a copier, a ticketing system, or a line-of-business app still signing in with a username and password over a legacy protocol. Microsoft has now put dates on when that stops working, and the early ones are closer than October 2022. This post covers what Microsoft announced in September 2021 and shares a set of multi-tenant PowerShell scripts we built to find basic auth across every customer you manage.

The full announcement: Basic Authentication and Exchange Online, September 2021 Update (opens in new tab)

What did Microsoft actually commit to?#

• The scope covers Exchange Web Services (EWS), Exchange ActiveSync (EAS), POP, IMAP, Remote PowerShell, MAPI, RPC, SMTP AUTH, and OAB.
• Effective October 1, 2022, Microsoft begins permanently disabling basic auth in all tenants, regardless of usage. The one exception is SMTP AUTH, which can still be re-enabled after that date.
• The part that should worry you most: beginning in early 2022, Microsoft will selectively pick tenants and disable basic auth for all affected protocols except SMTP AUTH for a period of 12 to 48 hours. You can request that specific protocols not be turned off on a per-tenant basis; instructions are in the announcement linked above.

Those temporary shutoffs mean "we will deal with it next year" is not a plan. A tenant you have not audited can lose a working integration for two days with no warning.

Where basic auth usually hides#

Before the scripts, the remediation picture:

• Inventory first. Identify basic auth within your customer tenants. The multi-tenant reporting scripts below do this across your whole base.
• SMTP auth deserves early attention even though Microsoft is not disabling it tenant-wide until October 2022:
  • You can disable SMTP auth at the tenant level and re-enable it per user or per account, as described in Securing Authenticated SMTP in Exchange Online (opens in new tab).
  • For copiers and printers, look at options 2 or 3 in How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (opens in new tab).
  • PowerShell can confirm whether SMTP auth is enabled or disabled at the tenant level: Enable or disable SMTP AUTH (opens in new tab).
• Check your ticketing systems. Any helpdesk or PSA pulling mail over IMAP needs a modern auth path before the shutoff reaches it.

The reporting toolkit: three scripts, every tenant#

We published a GitHub repository built to help MSPs report basic authentication across all customers under management. It consists of three PowerShell scripts:

• Audit_Log_Activity.ps1 (opens in new tab) uses Azure AD sign-in logs to surface every basic auth sign-in within a 30-day window. Requires customers to have an Azure AD P1 license.
• Get_basicAuth_settings.ps1 (opens in new tab) uses Exchange Online PowerShell to look for tenant-wide basic auth settings.
• SMTP_auth_disabled.ps1 (opens in new tab) uses Exchange Online PowerShell to check the tenant-wide SMTP auth setting.

What you need before running them#

The scripts authenticate through the Secure Application Model, which gives you a headless connection into all of your customer environments. You will need to gather the tokens and GUIDs it produces. Kelvin Tegelaar at CyberDrain maintains the script that sets this up: Create-SecureAppModel.ps1 on GitHub (opens in new tab).

Audit_Log_Activity.ps1: who is still signing in the old way#

Make sure your app registration carries this permission:

Microsoft Graph => AuditLog.Read.All (Delegated)

The script walks each customer tenant, looks for basic auth sign-ins, and presents them on screen:

It also generates a CSV listing every basic auth sign-in found across all customers, ready for remediation planning or a customer conversation:

Get_basicAuth_settings.ps1: what each tenant allows#

This script pulls all authentication settings within a tenant. In the UI, most of these live under Settings > Org Settings > Modern Authentication:

One caveat to know going in: if the settings in a tenant have never been modified, the PowerShell cmdlets do not return them. For tenants sitting on untouched defaults, this script may come back empty, so treat a blank result as "defaults in place," not "nothing to do."

SMTP_auth_disabled.ps1: the copier-and-printer check#

SMTP auth tends to be the most common holdout because of devices like copiers and printers. It can be enabled or disabled at both the tenant level and the user level, and the two can disagree: a tenant can have SMTP auth off globally while individual users still have it on. This script checks the tenant-level setting for each company and reports the results to a CSV:

Run all three, and you have a defensible picture of where every customer stands before Microsoft starts flipping switches.