Azure AD Sign-ins Using Legacy Authentication Client Applications
Alerts on Azure sign-ins using legacy protocol client apps (IMAP/POP3/SMTP/EWS/ActiveSync), which may indicate risky authentication usage.
- Product
- azure
- Service
- signinlogs
- Author
- Yochana Henderson, '@Yochana-H' (SigmaHQ), DRL 1.1
- Published
- 2022-06-17
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Azure AD sign-in events where authentication is attempted using legacy protocol client types (e.g., IMAP, POP3, MAPI, SMTP, Exchange ActiveSync, and Exchange Web Services). Attackers may use legacy authentication to gain or maintain access and to blend in with non-interactive or older client behaviors. The detection relies on Azure sign-in log telemetry including the sign-in activity type, client application classification, and the presence of a UPN in the event.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure AD Sign-ins Using Legacy Authentication Client Applications
id: f87c63b0-c10b-4455-9ea0-fed2c54afa77
status: test
description: This rule flags Azure AD sign-in events where authentication is attempted using legacy protocol client types (e.g., IMAP, POP3, MAPI, SMTP, Exchange ActiveSync, and Exchange Web Services). Attackers may use legacy authentication to gain or maintain access and to blend in with non-interactive or older client behaviors. The detection relies on Azure sign-in log telemetry including the sign-in activity type, client application classification, and the presence of a UPN in the event.
references:
- https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml
author: Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-06-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.t1078.004
- attack.t1110
logsource:
product: azure
service: signinlogs
detection:
selection:
ActivityDetails: Sign-ins
ClientApp:
- Other client
- IMAP
- POP3
- MAPI
- SMTP
- Exchange ActiveSync
- Exchange Web Services
Username: UPN
condition: selection
falsepositives:
- User has been put in acception group so they can use legacy authentication
level: high
license: DRL-1.1
related:
- id: 60f6535a-760f-42a9-be3f-c9a0a025906e
type: derived