Legacy sign-in report analyzer
Find out which users, apps and devices will break when Microsoft switches off password sign-in. Open a sign-in log export from Microsoft Entra to see everything still using legacy authentication – SMTP, IMAP, POP, ActiveSync, EWS and more.
Your file is read on your device, in your browser – it’s never sent to our servers.
Legacy sign-ins by protocol
| Client app | Users | Successful | Failed | What it means |
|---|
Users, apps and devices to fix
Successful legacy sign-ins are the ones that will break. Failed ones are already broken (or are password-guessing attacks – look at the IP addresses and locations).
| User | Client app | Application / user agent | Successful | Failed | Last seen (UTC) | IP addresses |
|---|
How to export your sign-in logs
- Open the Sign-in logs in the Microsoft Entra admin center (Identity → Monitoring & health → Sign-in logs). You need a role such as Reports Reader, Security Reader or Global Reader.
- Set the Date range – up to the last 30 days (7 days on the free tier).
- Optionally, choose Add filters → Client app, and select the Legacy Authentication Clients. This makes the export much smaller – but the analyzer filters them for you either way.
- Choose Download → Download CSV (or JSON). Repeat on the Non-interactive sign-ins tab, which is where most app and device sign-ins appear.
- Drop the files onto this page.
Large tenants can also use the Get-MgAuditLogSignIn Microsoft Graph PowerShell command, or Log Analytics, to export longer periods – save the results as CSV or JSON with the same column names.
Found apps or devices that can’t switch to OAuth?
Auth-Email lets printers, scanners, line-of-business apps and scripts keep using SMTP, IMAP and POP with a password, while it signs in to Microsoft 365 with OAuth on their behalf – no firmware updates, code changes or exceptions needed.
Frequently asked questions
How do I export my sign-in logs?
In the Microsoft Entra admin center, go to Identity → Monitoring & health → Sign-in logs, choose a date range, add a filter for Client app with the legacy authentication clients selected, then choose Download → Download CSV (or JSON). Download both the interactive and non-interactive sign-ins if you can.
Is my sign-in data uploaded?
No. The report is read and analyzed in your browser, on your device – nothing is sent to our servers.
What counts as legacy authentication?
Microsoft treats sign-ins from these client apps as legacy authentication: Authenticated SMTP, IMAP4, POP3, Exchange ActiveSync, Exchange Web Services, Autodiscover, MAPI over HTTP, Offline Address Book, Outlook Anywhere (RPC over HTTP), Exchange Online PowerShell, Reporting Web Services, Universal Outlook and Other clients.