After a Conditional Access policy blocks legacy authentication, staff using an old mail client can no longer connect. What resolution keeps the security posture intact?
Show answer and explanation
Answer: A
Legacy protocols such as older IMAP, POP and SMTP AUTH cannot perform modern authentication and therefore cannot satisfy MFA or Conditional Access. The durable fix is to upgrade the client to one that supports modern authentication, such as a current Outlook release, Outlook on the web or a mobile app. That restores connectivity while keeping the block in place. A staged transition, with communication and a pilot group, avoids a hard cut-over while still closing the protocol gap.
Why the other options are wrong
- B. Excluding users reopens the legacy path for them, which is exactly the attack vector the policy was created to close.
- C. Disabling MFA weakens every sign-in for those users and still leaves legacy clients unable to satisfy Conditional Access.
- D. Basic authentication is the legacy mechanism being blocked. Re-enabling it reverses the security control and exposes credentials to interception.
Exam tip. Fix the client, not the policy, when legacy auth is blocked.