Who is still using POP3, IMAP and SMTP in your tenant

Microsoft turned basic authentication off in Exchange Online, so the question feels settled. It isn't. What was disabled is one credential format; the protocols themselves — POP3, IMAP4, SMTP client submission, Exchange ActiveSync, EWS — are still enabled per mailbox in most tenants, still reachable, and still the first thing an attacker tries because they fail predictably and quietly. The honest version of the question is not "do we allow basic auth" but which mailboxes still have legacy protocols switched on, and who is actually connecting through them right now. That answer is in your sign-in logs, and almost nobody reads it.

Why a protocol session is a different risk from a browser session

An interactive sign-in goes through the full Entra ID pipeline: Conditional Access evaluates it, MFA can be demanded, sign-in risk can block it, the session can be revoked. A mail client speaking IMAP over OAuth gets a token once and then holds a long-lived session that no policy re-evaluates in practice. A client speaking anything older gets no interactive step at all. Both land in the non-interactive sign-in log — a separate tab most admins have never opened — and neither generates a prompt anyone would notice.

What each protocol is still doing in a real tenant

Every row that survives the audit ends up on a service account, and service accounts are the population least likely to have a second factor registered — the same overlap described in dormant accounts that still hold licences. A shared password, a protocol that never challenges it, and a mailbox full of invoices is the whole business email compromise playbook in three lines.

Naming them, in four passes

Why this audit keeps not happening

The data exists in two places that don't talk to each other: the mailbox configuration lives in Exchange Online PowerShell, the usage lives in the Entra sign-in logs, and joining them means an export, a second export, and a spreadsheet. Worse, the sign-in log is the perishable half — 7 days of retention without Entra ID P1, 30 with it — so an audit done twice a year is looking at a window that has already closed. Across a dozen tenants, the same join has to be rebuilt a dozen times, which is exactly why it becomes an annual ritual instead of a monthly check (a cost quantified in the licence waste audit, where the same manual-export tax shows up against money instead of risk).

GraphPaaS syncs sign-in activity, mailbox configuration and licence assignment per tenant on the same schedule, so "which accounts used a legacy protocol this month, and which of them have no second factor" is a filter rather than a project — and the trend survives past the retention window Microsoft gives you.