MT.1185: Block legacy MSOnline (MSOL) PowerShell module.

ID	MT.1185
Severity	Medium
Suite	Mito
Product	Entra ID
Feature	User and directory settings
Security area	Access control
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:CM-7 Least Functionality
MITRE ATT&CK	T1059.009, T1078.004
Reads from	Microsoft Graph

What this checks and how to fix it

Description

Checks if the legacy MSOnline (MSOL) PowerShell module is blocked from authenticating to the tenant.

Why This Matters

The MSOnline (MSOL) and Azure AD PowerShell modules were retired by Microsoft and no longer receive security updates. Because they predate modern authentication controls, requests made through them can be a weaker, less-monitored path into a tenant’s identity administration than the current Microsoft Graph PowerShell SDK.

The blockMsolPowerShell setting on the tenant’s authorization policy lets an admin explicitly block authentication requests from the legacy MSOnline PowerShell module’s service principal. This isn’t enabled by default for every tenant, so it needs to be checked explicitly rather than assumed to already be in place — leaving it unblocked keeps an unsupported and unmonitored administrative access path open.

Remediation action

1. Connect to Graph using Connect-MgGraph -Scopes “Policy.ReadWrite.Authorization”.
2. Run the following PowerShell command to review the current value:

Get-MgPolicyAuthorizationPolicy | Select-Object BlockMsolPowerShell

3. If BlockMsolPowerShell is $false, block the legacy MSOnline PowerShell module:

# This example uses the cmdlet syntax published in the Microsoft Learn documentation:
# https://learn.microsoft.com/powershell/module/microsoft.graph.identity.signins/update-mgpolicyauthorizationpolicy
$params = @{
    blockMsolPowerShell = $true
}
Update-MgPolicyAuthorizationPolicy -BodyParameter $params

Related links

• Authorization policy in Entra ID | Microsoft Learn
• Update-MgPolicyAuthorizationPolicy | Microsoft Learn - Graph PowerShell v1.0

---

Mito check. Author: BakkerJan. Open-source licences.