Microsoft is set to implement significant security enhancements within its Microsoft 365 suite by blocking various legacy authentication protocols starting mid-July 2025. This initiative is part of the company's Secure Future Initiative (SFI) and Secure by Default strategy, aiming to bolster the security of the Microsoft 365 environment. Organizations relying on older systems should prepare promptly to ensure a seamless transition.
Key Changes and Affected Protocols
The primary focus of this update is the deprecation of Basic Authentication for Client Submission (SMTP AUTH) in Exchange Online. Basic Authentication, which transmits usernames and passwords in plain text, is particularly vulnerable to credential theft, phishing, and brute force attacks. To mitigate these risks, Microsoft will permanently disable Basic Authentication for SMTP AUTH in September 2025. After this date, applications and devices must use OAuth for SMTP AUTH to send emails. (techcommunity.microsoft.com)
Additionally, Microsoft plans to block the FrontPage Remote Procedure Call (RPC) protocol, a remnant from the discontinued Microsoft FrontPage web design tool. Despite its obsolescence, the protocol has remained in use and is now recognized as a security liability due to its susceptibility to attacks.
Impact on Third-Party Applications
Another significant change involves third-party applications accessing files and websites within Microsoft 365. Moving forward, these applications will require explicit consent from an administrator. This measure aims to reduce the risk of uncontrolled data access by end-users, thereby enhancing overall security. Users wishing to utilize third-party apps will need to obtain prior approval from their administrators.
Recommended Actions for Organizations
Organizations should take the following steps to prepare for these changes:
- Assess Current Authentication Methods: Identify any applications or devices currently using Basic Authentication for SMTP AUTH and plan to transition them to OAuth before September 2025.
- Update or Replace Legacy Systems: Evaluate systems relying on deprecated protocols like FrontPage RPC and consider updating or replacing them with more secure alternatives.
- Review Third-Party Application Access: Implement processes for reviewing and approving third-party applications that require access to Microsoft 365 resources, ensuring they meet security standards.
Source: Research Snipers Microsoft 365 to Block Legacy Authentication Protocols Starting Mid-July – Research Snipers