tools/legacy-auth-usage

Who actually still uses legacy auth?

Before you flip the block-legacy-auth policy, see who breaks. This reads your sign-in logs for legacy protocol traffic — IMAP, POP, authenticated SMTP, ActiveSync, "other clients" — and shows which accounts and apps used them, with successes and failures separated (failures on legacy protocols are usually password spray). Read-only, rendered in your browser only.

legacy-auth-usage --sign-in

Delegated read-only permission: AuditLog.Read.All Only hosts contacted: login.microsoftonline.com · graph.microsoft.com Verify it: DevTools → Network while this runs

Sign in with a work account holding Security Reader, Reports Reader, or higher. Reading sign-in logs via Graph requires the tenant to have at least one Entra ID P1 licence (included in Business Premium, E3, E5).

legacy sign-ins by account

account	protocol	app	last seen	ok	fail

Ready to block it? ./ca-policy-check verifies your Conditional Access covers legacy auth — and the fixed-price assessment closes the rest → ./view pricing

questions before you sign in

▸What exactly am I consenting to?

One delegated, read-only Microsoft Graph permission: AuditLog.Read.All — the same permission the mfa-coverage-check uses, so if you've run that, no new consent is needed. It reads sign-in log entries; it cannot change anything in your tenant.

▸How do I verify nothing leaves my browser?

Open DevTools (F12) → Network, then run the tool. You'll see login.microsoftonline.com and graph.microsoft.com — nothing else. No calls to us, no analytics. The page source is unminified if you'd rather read it.

▸Why might results be incomplete?

Graph sign-in logs retain 30 days (P1/P2). Very high-volume tenants are sampled — this tool caps at 2,000 events per protocol and tells you if it hit the cap. Interactive sign-ins only; some non-interactive legacy traffic may not appear. Treat "zero found" over 30 days as strong — but stage your block policy in report-only first regardless.

▸How do I revoke access afterwards?

Entra admin centre → Enterprise applications → Sentavo Tools → Delete. The session token lives in this tab's session storage and dies when you close it.

Reads /auditLogs/signIns via Microsoft Graph with delegated permissions. Legacy protocols checked: Exchange ActiveSync, IMAP4, POP3, Authenticated SMTP, Other clients. Results render entirely client-side; nothing is transmitted or stored.