Legacy authentication
Older sign-in protocols that cannot support MFA, and are therefore a standing bypass of it.
Protocols such as IMAP, POP3, SMTP AUTH, and older Office clients authenticate with a username and password alone. If they remain enabled, an attacker with a valid password can use them to sidestep every MFA policy you have configured.
Microsoft has disabled most of these by default in newer tenants, but older tenants and specific exceptions granted for a device or application frequently persist. Auditing what still uses them is worth doing before assuming MFA is enforced everywhere.
Where this comes up
Legacy authentication sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.