Authentication

OAuth 2.0 for Microsoft 365: when app passwords do not exist

12 Sept 2026·3 min read

With most providers the recipe is simple: enable two-factor, issue an app password, migrate. Microsoft 365 does not work that way — that door has been closed.

What exactly was turned off

Exchange Online stopped accepting an ordinary username and password over IMAP. That is basic authentication, the legacy kind. The refusal arrives at login and reads like a wrong password, even though the password is right.

App passwords of the Google or Apple kind generally do not exist in Microsoft 365: the default security policy does not issue them. So the usual advice to create one simply cannot be followed here.

What replaces it is OAuth 2.0, where the client receives an access token instead of a password. Over IMAP that token is carried by the XOAUTH2 extension.

What a basic auth attempt gets back

a1 LOGIN "user@company.com" "********"
a1 NO LOGIN failed. Basic authentication is disabled for this tenant.

How it works in practice

The user signs in on the normal Microsoft page, passes the second factor and agrees to give the application access to mail. The application receives a token limited in scope and in time, and uses it over IMAP.

For a migration that beats a password twice over: the token cannot be used to sign in to the account, and it expires on its own even if everyone forgets about it.

The permission needed is IMAP access on behalf of the user (IMAP.AccessAsUser.All in Microsoft terms).
Consent comes either from the user or from a tenant administrator on everyone behalf.
Tokens are short-lived; a long migration needs a refresh token, which the client renews itself.
Revocation is central too: an administrator closes the application access with one click.

If you are not an administrator

This is the most common dead end: company mail, no rights, and a move to make.

Check whether IMAP is enabled for your mailbox at all — an administrator can disable the protocol separately from authentication.
Ask the administrator either to grant consent for the migration application or to allow legacy authentication for one mailbox for the duration of the move.
If neither is possible, migrating in the other direction usually still works: pull the mail to another server and upload from there with the access you do have.
As a last resort, export with the Microsoft 365 tooling and upload the resulting archive to the new server over IMAP.

How this differs from Outlook.com

Personal Outlook.com and Hotmail mailboxes are a separate story from corporate Microsoft 365, similar interface notwithstanding. They have their own access settings, changed on their own schedule.

One practical conclusion: with any Microsoft address, test the connection before copying anything. It takes seconds and states exactly what is missing.

FAQ

Common questions

Can I create an app password in Microsoft 365?

In most tenants, no: the default policy does not issue them. OAuth is the supported path.

Is a token safer than a password?

Yes: it cannot sign in to the account, its scope is limited to mail, and it expires by itself.

What does the tenant administrator have to do?

Grant the application consent for IMAP mail access, or as a temporary measure allow legacy authentication for a specific mailbox.

The server says AUTHENTICATIONFAILED — is that always OAuth?

Not necessarily. The same code appears when IMAP is disabled or the username format is wrong; there is a full write-up of the causes.

Where to next

Move from Gmail to Microsoft 365 AUTHENTICATIONFAILED explained IMAP settings by provider

Move your mail with MoveMailbox

Access4 min read

App passwords: why you need one and where to get it

A separate password for IMAP instead of your account one: who requires it, where each provider keeps it, and what to do when the section will not appear.

Planning4 min read

How long does moving a mailbox take

Speed is capped by the two mail servers, not by the software. How to estimate the time in advance and what to expect from a mailbox of tens of gigabytes.

Gmail3 min read

Why a Gmail migration doubles your message count

Labels versus folders and the All Mail folder: the number one cause of doubled volume and duplicates, and what to exclude before you start.

Find out how big your mailbox is. It costs nothing.

Connect two servers, look at the size and decide. Or take the client and keep everything on your side.

Start the transfer Download for Windows

Code on GitHub · built on imapsync · no sign-up