Question about legacy auth and CA policy to block it

Hello all,

I am 99% sure I know the answer to this already but wanted to get some reassurance from the community.

Our tenant still uses basic auth as we still have printers and apps that depend on it. We are slowly transitioning what we can to modern auth and HVE (printers) so for now we are stuck with basic auth SMTP until they turn it off.

We would like to at least block the legacy auth/clients for privileged roles as they showed up on an assessment/audit.

Been looking at the sign in logs and under the "Client Apps" filter, we select all legacy clients except for SMTP and we have had 0 hits the last 30 days for interactive/non-interactive sign ins, so good there.

However, under the "Service Principals" and "Managed Identity" section of the logs, there are ton of activity. It looks like the "Client Apps" filter does not apply to these to sections and they are only showing service principals and managed identity using modern auth.

I have been search but my Google-fu must be rusty as the only answer I see in MS articles is that as long as there are no interactive/non-interactive log ins, we are clear but would really like to confirm that the case.

Thank you