Block Legacy Authentication

Connect-MgGraph -Scopes "AuditLog.Read.All"

# Legacy auth client app types
$legacyClientApps = @(
    "exchangeActiveSync", "imap", "pop3", "smtp",
    "mapi", "other"
)

# Tìm sign-ins dùng legacy auth trong 14 ngày qua
$since = (Get-Date).AddDays(-14).ToString("yyyy-MM-ddTHH:mm:ssZ")
$results = @()

foreach ($app in $legacyClientApps) {
    $signIns = Get-MgAuditLogSignIn `
      -Filter "clientAppUsed eq '$app' and createdDateTime ge $since" `
      -Top 50 |
      Select-Object UserPrincipalName, ClientAppUsed,
        AppDisplayName, CreatedDateTime,
        @{N="OS";E={$_.DeviceDetail.OperatingSystem}}
    $results += $signIns
}

# Tổng hợp: ai đang dùng legacy auth
$results | Group-Object UserPrincipalName |
  Select-Object Name, Count, @{N="Apps";E={($_.Group.ClientAppUsed | Sort-Object -Unique) -join ", "}} |
  Sort-Object Count -Descending |
  Format-Table -AutoSize

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

$bgId = (Get-MgUser -Filter "UserPrincipalName eq '[email protected]'").Id

$params = @{
    displayName = "CA-AZ500-BlockLegacyAuth"
    state = "enabledForReportingButNotEnforced"   # Report-only mode
    conditions = @{
        users = @{
            includeUsers = @("All")
            excludeUsers = @($bgId)
        }
        applications = @{
            includeApplications = @("All")
        }
        clientAppTypes = @(
            "exchangeActiveSync",   # EAS legacy
            "other"                 # IMAP, POP3, SMTP AUTH, MAPI, EWS, Basic Auth
        )
        # Modern auth (browser, mobileAppsAndDesktopClients) NOT included = not blocked
    }
    grantControls = @{
        operator        = "OR"
        builtInControls = @("block")
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params
Write-Host "CA-AZ500-BlockLegacyAuth created in Report-only mode"

# Bật policy On
$policyId = (Get-MgIdentityConditionalAccessPolicy `
  -Filter "displayName eq 'CA-AZ500-BlockLegacyAuth'").Id

Update-MgIdentityConditionalAccessPolicy `
  -ConditionalAccessPolicyId $policyId `
  -State "enabled"

# Kiểm tra sign-in log - legacy auth bị block
$since = (Get-Date).AddHours(-2).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn `
  -Filter "createdDateTime ge $since and clientAppUsed ne 'Browser' and clientAppUsed ne 'Mobile Apps and Desktop Clients'" `
  -Top 20 |
  Select-Object UserPrincipalName, ClientAppUsed,
    @{N="Status";E={if($_.Status.ErrorCode -eq 0){"Success"}else{"Blocked ($($_.Status.ErrorCode))"}}} |
  Format-Table -AutoSize