Blog series

This is the last part of the series on “Phase out Legacy Authentication”.

1. Preface
2. Enable Modern Authentication
3. Create prerequisites
4. Gain insights
5. The first 90%
6. The next 9%
7. Endgame

A lot of work lies behind you when you arrive here. Starting with the necessary preliminary work, the required changes, through reporting and maintaining exception lists.

But the biggest hurdle for the next step was definitely the last 9%. Finding and removing every exception is time-consuming and tedious. Depending on the environment, this last step can take anywhere from a few days to half a year.

Blog series

This is part three of the six-part series on “Phase out Legacy Authentication”.

1. Preface
2. Enable Modern Authentication
3. Create prerequisites
4. Gain insights
5. The first 90%
6. The next 9%
7. Endgame

Recap

Having disabled the majority of users who do not use Legacy Authentication in the last article, it is now time to use the methods outlined in part three to identify the user groups that are still affected.

This data will be used to create an action plan for the deactivation of Legacy Authentication for these user groups. Additionally, the data will be used to transition the Conditional Access Policy “Temporary Policy: Block legacy authentication rollout” to Phase 2.

The error

These two sentences in the Intune documentation are very important when you want to deploy a SCEP profile.
If you do not follow them exactly, the following phenomenon will occur.

Blog series

This is part three of the six-part series on “Phase out Legacy Authentication”.

1. Preface
2. Enable Modern Authentication
3. Create prerequisites
4. Gain insights
5. The first 90%
6. The next 9%
7. Endgame

Recap

The first three parts of the series set the stage (1/2) for the deactivation and used Entra ID (Azure AD) workbooks and Kusto queries to identify the first usergroup.

Add AAD group members

To go straight ahead, the Entra ID (Azure AD) group CAPolicy-Include-Block-Legacy-Authentication must be populated with the users from the last query. / This prevents these users from beginning to use legacy authentication protocols in the next few weeks.

Blog series

This is part three of the six-part series on “Phase out Legacy Authentication”.

1. Preface
2. Enable Modern Authentication
3. Create prerequisites
4. Gain insights
5. The first 90%
6. The next 9%
7. Endgame

Recap

In the first part, Modern Authentication was enabled and in the second part, the prerequisites were created to create detailed reports and to disable Legacy Authentication for individual users.

Conditional Access policy logic

To better understand how it is possible to block individual users, let’s take a look at the Conditional Access Policies created and the login associated with them.

Blog series

This is part three of the six-part series on “Phase out Legacy Authentication”.

1. Preface
2. Enable Modern Authentication
3. Create prerequisites
4. Gain insights
5. The first 90%
6. The next 9%
7. Endgame

Recap

In the first part of the series, Modern Authentication was enabled for all Microsoft 365 services and can now be used.

This part is about creating the prerequisites to gain a detailed insight into the usage of the different authentication methods and to make it possible to disable legacy authentication per user.