Exchange mail flow guides › Authentication and SMTP errors

Basic authentication is gone: fetching a Microsoft 365 mailbox by IMAP or POP3 with OAuth2 into Exchange

Exchange Online no longer accepts a username and password for POP3 and IMAP; a connector that reads a Microsoft 365 mailbox must obtain an OAuth 2.0 token through a Microsoft sign-in and refresh it automatically, which is why “the password is correct but it keeps asking” is the symptom, not the problem. This guide explains what Microsoft switched off, what a service has to do instead, and the seven steps that connect a Microsoft 365 or Outlook.com mailbox to a POP3/IMAP connector for an on-premises Exchange Server.

Updated on 2026-09-23

What Microsoft switched off

Microsoft’s page Deprecation of Basic authentication in Exchange Online opens with the sentence that matters: Basic authentication is now disabled in all tenants, and nobody — neither the tenant administrator nor Microsoft support — can re-enable it. Basic authentication means the application sends a username and password with every request. Microsoft removed it for Exchange ActiveSync, POP, IMAP, Remote PowerShell, Exchange Web Services, the Offline Address Book, Autodiscover and Outlook for Windows and Mac, and disabled SMTP AUTH in every tenant where it was not in use. The cut-off for most cloud environments was 1 October 2022; after 31 December 2022 the switch could no longer be turned back on.

Protocol on Exchange Online	Username and password (Basic)	OAuth 2.0 (modern authentication)	Where Microsoft documents it
IMAP4 — outlook.office365.com, port 993, SSL/TLS	Refused in every tenant	Supported since 2020; the application presents a token	Deprecation page; POP3 and IMAP4 in Exchange Online
POP3 — outlook.office365.com, port 995, SSL/TLS	Refused in every tenant	Supported since 2020	same pages
SMTP AUTH — smtp.office365.com, port 587, STARTTLS	Disabled where it was unused; Microsoft has announced the retirement of Basic authentication for SMTP AUTH	Supported since 2020	Deprecation page
App passwords	Do not help: the deprecation also prevents app passwords with apps that do not support two-step verification	—	Deprecation page
Outlook as a POP3/IMAP client	Refused	Not available: Microsoft states there is no plan for Outlook clients to support OAuth for POP and IMAP; Outlook connects with MAPI/HTTP or EWS instead	Deprecation page; Can’t connect to Outlook by using POP/IMAP and Modern authentication

Two more details from the same Microsoft pages explain many support cases. If security defaults are enabled in the tenant, POP3 and IMAP4 are automatically disabled in Exchange Online, so even a correct OAuth2 setup logs in to nothing until an administrator enables the protocol for the mailbox. And the reason Microsoft gives for the whole change is worth repeating to whoever asks for the old way back: a stored password can be captured and reused against other services, while an OAuth access token has a limited lifetime and is specific to the application and resource it was issued for.

What OAuth 2.0 means for a service that runs unattended

A mail client with a person in front of it can sign in whenever Microsoft asks. A connector service that empties a mailbox every minute cannot, so the mechanism has to work without anyone watching. Microsoft’s developer page Authenticate an IMAP, POP or SMTP connection using OAuth describes the pieces:

• The application is registered with Microsoft Entra — by the application’s developer, once. The registration is what the consent screen later names. POPcon ships as such a registered application; its version history for 4.10.0 describes the current form as a public-client app registration with PKCE and no client secret in the installer.
• The user signs in once and consents. The application asks for a permission scope — for IMAP it is IMAP.AccessAsUser.All, for POP3 POP.AccessAsUser.All — and for offline_access. When the user approves that, Microsoft’s token endpoint issues a refresh token.
• Refresh tokens are long-lived. Microsoft’s wording: the app can get new access tokens as older ones expire. That is the part that keeps a service running for months without a further sign-in. The connector stores the refresh token, not a password.
• The token travels inside the protocol. The IMAP AUTHENTICATE XOAUTH2 command carries the user name and the access token in the SASL XOAUTH2 format instead of a password; POP3 uses AUTH XOAUTH2. Nothing else about IMAP or POP3 changes: folders, message download and delete-after-download work as before.
• Shared mailboxes are reached with a token obtained for a user who has access to them, with the shared mailbox’s address as the user name in the XOAUTH2 string — Microsoft documents this case on the same page.

For the administrator this reduces to one practical rule: the sign-in happens in a browser on the machine where the connector runs, once per Microsoft account, with the account that owns the mailbox. After that the connector is on its own.

Step by step: a Microsoft 365 mailbox in POPcon

The steps below are the ones from the knowledge-base article Connect to Microsoft 365 or Outlook online accounts with OAuth2, which also carries a screenshot of each screen. POPcon has supported OAuth 2.0 for Microsoft and Google accounts since version 4.8.1 (September 2024); the Microsoft flow was rebuilt in 4.10.0 (May 2026).

1. Set the account to IMAP on outlook.office365.com, port 993. In the connector's account settings choose IMAP as the server type, enter outlook.office365.com as the server and 993 as the port. Microsoft lists outlook.office365.com with port 993 and SSL/TLS as the IMAP4 setting for Exchange Online.
2. Select “OAuth2 Microsoft” as the authentication type. Leave the password field alone. With OAuth2 selected, the connector never sends a password to Microsoft.
3. Click “Connect OAuth2”. A Microsoft sign-in page opens in the browser on that machine.
4. Sign in with the mailbox account and complete MFA. Sign in as the Microsoft 365 user whose mailbox is to be fetched and complete the identity verification Microsoft requests, for example the Authenticator prompt.
5. Grant the connector permission to read the mailbox. Microsoft shows the permissions the application asks for; the consent page names the application “POPcon email forwarding”. Accept.
6. Check that the status reads “Authenticated”. Back in the connector the account status changes to Authenticated. The token is stored and refreshed by the connector from now on.
7. Run “Test access”. The test logs in to the mailbox with the token. If it passes, the account is ready and the schedule takes over.

No password is entered at any point. The OAuth token is maintained and refreshed automatically by POPcon; the only thing that expires is the consent, and that survives the connector’s own service restarts and Windows updates. The walkthrough contains no step in which you register anything in your own tenant: the sign-in consents to POPcon’s registered application, which is why the consent page says “POPcon email forwarding” rather than the name of your organisation.

Symptoms, and what each one really means

What you see	Cause	What to do
Login fails although the password was just reset and is correct	Basic authentication is disabled tenant-wide; the password is never checked	Set the account to OAuth2 Microsoft and run Connect OAuth2 once. Do not create app passwords.
OAuth2 sign-in succeeds, then the connector cannot open the mailbox	POP3/IMAP4 disabled for the mailbox or the tenant (security defaults, or the per-user setting)	An administrator enables IMAP4 (or POP3) for that mailbox in Exchange Online; Microsoft’s POP3 and IMAP4 page links the per-user procedure.
The Microsoft consent page shows an error instead of the Accept button	The tenant restricts user consent to applications	An administrator grants the permission or adjusts User consent settings in Microsoft Entra ID.
Accounts that worked for months ask for the sign-in again after a connector update	The application registration changed (POPcon 4.10.0)	Click Connect OAuth2 once per Microsoft account; nothing else to change.
Outlook itself cannot be set up as a POP3/IMAP client for the same mailbox	Outlook has no OAuth for POP/IMAP, by Microsoft’s own statement	Not a connector problem. Outlook users connect with an Exchange profile; the connector keeps using IMAP with OAuth2.

IMAP or POP3 for a Microsoft 365 mailbox?

Microsoft offers both, on the same host: IMAP4 on port 993 and POP3 on port 995, each with SSL/TLS, and OAuth 2.0 for each. The POPcon walkthrough for Microsoft 365 uses IMAP, and the knowledge-base article states that POP3 with OAuth2 is not available there for Microsoft accounts, so in practice the choice is made: IMAP on 993 with OAuth2 Microsoft. IMAP also has the property Microsoft describes for it — by default it does not remove downloaded messages from the server — which suits a connector that empties a mailbox on a schedule and, for a shared or migrated mailbox, may be asked to leave copies behind for a while. For Gmail and Google Workspace the same OAuth2 pattern applies with Google’s sign-in; the knowledge base has the Gmail walkthrough.

Where the mailbox lives at a provider that still accepts a password — IONOS, Strato, GMX and most others — the account is set up with server type, port and password as described in How to download POP3 and IMAP mailboxes into Exchange Server 2016, 2019 and SE. Only the provider side of the connection changes with OAuth2; the delivery into Exchange over SMTP through the receive connector is the same for every account.

Frequently asked questions

More in the Exchange mail flow guides, on the POPcon product page, the download page or in the knowledge base. Auf Deutsch: Ohne Basic Authentication: Microsoft-365-Postfächer per IMAP mit OAuth2 nach Exchange holen.