Microsoft Mail's OAuth authorization requirements have been tightened. How can email clients ensure compliance with these regulations?

Microsoft's official documentation indicates that IMAP, POP, and SMTP protocols fully support OAuth authentication. Individual users and enterprise administrators should choose the appropriate method based on their permissions, token management practices, and protocol requirements. This ensures that connection failures are avoided due to the use of outdated passwords or incorrect parameters. This article outlines the applicable scenarios, possible reasons for failure, and recommended account control measures.

Applicable scenarios and key changes

According to Microsoft's official documentation, both Microsoft 365 and Outlook.com users can access IMAP, POP, and SMTP services using OAuth 2.0. This means that email clients, automated scripts, and mobile applications need to use standardized authorization methods such as authorization codes, device codes, or client credentials to access mailbox data.

This change involves transferring permission control from email passwords to tokens. The scope of access is now determined by explicit approval from users or administrators within Microsoft Entra. For users who have been using third-party tools for managing emails over a long period, the method of access needs to be re-evaluated, especially in scenarios involving shared email accounts, bulk email sending, or background tasks.

Token acquisition and permission boundaries

Microsoft requires that applications first register with Microsoft Entra, then obtain access tokens, and ensure that the appropriate scopes are specified according to the protocol: IMAP corresponds to IMAP.AccessAsUser.All, POP corresponds to POP.AccessAsUser.All, and SMTP uses SMTP.Send for sending messages. When requesting tokens, it is also necessary to include the Outlook resource address to avoid issues related to insufficient permissions.

If the application needs to run indefinitely, it is recommended to request offline_access simultaneously. This will allow the application to obtain refresh tokens, and when the old tokens expire, the application can obtain new ones. Refresh tokens have a long validity period, making them suitable for scenarios where continuous synchronization is required. However, they must be stored securely within the application itself. Any exposure of these tokens in plain text could increase the risk of account takeover.

Protocol connection issues and reasons for failure

All three types of protocols use the SASL XOAUTH2 format. The username and Bearer token are encoded according to a fixed structure before being converted to Base64 format. IMAP submits the token after the AUTHORIZE XOAUTH2 command, while POP submits it in two lines. SMTP sends the token after returning the code 334 on the server side. Any step missing from this process will result in failure.

According to the official examples, IMAP and POP failures will respectively return messages indicating "NO" or "ERR". For SMTP issues, the error code 535 will be returned, indicating an authentication failure. Common causes include expired tokens, incorrect scope settings, incorrect username entries, or the application not being registered with Entra. When a failure occurs, it is necessary to first check whether the protocol, scope, and token are consistent. Then, investigate potential network and permissions-related issues.

Shared email addresses and backend task integration

When an application needs to access a shared email account, the token still needs to represent a specific user. However, in XOAUTH2 encoding, the “user” field should be replaced with the address of the shared email account. If a regular user’s address is used instead, the server will refuse to perform authentication. This is one of the most common pitfalls in using shared accounts for authentication purposes.

For automated background tasks, Microsoft allows the use of client credential streams. This approach enables invocation of services through the Service Principal Call protocol, without the need for individual users to log in. However, this method requires tenant administrators to register service principals in Exchange Online and grant appropriate permissions for specific email addresses. This approach is suitable only for controlled environments and not suitable for unrestricted use with individual accounts.

Compliant recommendations that users can implement

Individual users should prioritize using the official client or well-established applications that support OAuth authentication. It’s also important to enable multi-factor authentication whenever possible. Avoid storing tokens or refreshing tokens on public devices. For third-party tools that aren’t used frequently, it’s necessary to regularly review their permissions to ensure they aren’t granted privileges beyond what is necessary for sending and receiving emails.

Administrators should include both shared email accounts and backend services in the Entra and Exchange permission lists. They should define the scope of each privilege and ensure that email accounts are properly authorized. Additionally, they should use the official PowerShell interfaces to register service entities and authorize email accounts. This ensures that the authorization process is traceable and reversible, thereby preventing unauthorized access in the long term.

resources

Authenticate an IMAP, POP or SMTP connection using OAuth | Microsoft Learn

Data verification date: 2026-10-22.