365 - what protocols to disable

[Jobos]

Looking through the Azure logs there are many failed logins from addresses linked to malicious activity or failed logins because of password errors. The only account so far without these hacking attempts is the 365 admin account because it's an obscure name or hidden from the address book as 6 months ago a teacher account was hacked and started sending spam and this I expect is how they got the address book.

 

Azure lists the client app as 'other clients; IMAP' so I'm wanting to get 365 locked down better than it is. What protocols should I disable? Most users use either Office 2016 or Outlook via a browser and some have the Outlook mobile app.

 

Using a test account I disabled IMAP and POP and everything still works as I tried all three above but I see 'Exchange web services' is enabled. Is that needed?

 

To disable IMAP and POP I'm planning to use this script or is there a better one? https://gcits.com/knowledge-base/disable-pop-imap-mailboxes-office-365

[seustice]

You can do it this way and it works, or you can use conditional access in the Azure portal if you have an Azure AD P1 or P2 licence.

[Jobos]

You can do it this way and it works, or you can use conditional access in the Azure portal if you have an Azure AD P1 or P2 licence.

 

We just have Azure free version.

[mavhc]

Disable IMAP and POP, legacy logins, enable 2FA. If people need to use desktop outlook you'll need EWS I think

[Jobos]

Thanks, that was easier than I expected. Just need to test with 2FA before rolling it out.