Last Updated: February 27, 2024
Issue
Users signing into Outlook.com through Basic authentication may experience recurring password prompts in Outlook and other third-party email applications. This is a known issue. We have taken actions to protect our customers and mitigate their risk to the increase in bad actors trying to gain access to their accounts.
For many years, applications have used Basic authentication to connect to servers, services, and API endpoints. Basic authentication simply means the application sends a username and password with every request, and those credentials are also often stored or saved on the device. Traditionally, Basic authentication is enabled by default on most servers or services, and is simple to set up. While Basic authentication was the standard at the time, Basic authentication makes it easier for attackers to capture user credentials, which increases the risk of those stolen credentials being reused against other endpoints or services.
Basic authentication is an outdated industry standard. Threats posed by it have only increased with time and we have already deprecated Basic authentication across numerous products. (For more information, see Improving Security - Together.) There are better and more effective user authentication alternatives.
In the coming months, we will be working to fully remove support for Basic authentication from Outlook.com, and only rely on OAuth (also known as Modern authentication). While we understand that this experience is frustrating, we are ultimately trying to protect our customers and the safety of their accounts. OAuth has become the industry standard, and Microsoft and Outlook have long supported it. Many third-party email applications have also adopted OAuth.
Microsoft will communicate timelines and a more detailed plan to retire Basic authentication in Outlook.com in the near future; however, we did want to provide details and guidance about how users can move from Basic authentication to OAuth which should eliminate the increased number of authentication prompts they may be seeing.
Recommended User Actions:
For users having problems connecting to their Outlook.com email, here are the ways they can update their accounts to use OAuth for authentication.
If you use Outlook for Windows:
Outlook supports OAuth in all current Microsoft 365 subscription SKUs and Outlook 2021 LTSC (any SKU with build 11601.10000 or higher) when connecting directly as Outlook.com. If your Outlook is configured to connect to Outlook.com using POP or IMAP, OAuth is not supported. This means that when Basic authentication is fully deprecated, it will no longer connect. For this scenario, you have a few options:
Option 1: Switch to Outlook.com/Exchange Syncing – Instead of using POP/IMAP and SMTP, create a new Outlook Desktop profile and then add your Outlook.com account using automatic account configuration, which will add the account with OAuth. To do this, please use the following guidance:
-
Create a new Outlook Desktop profile, Create an Outlook profile.
-
Add your Outlook.com account, Add an email account to Outlook.
Option 2: Get a newer Outlook email app which supports OAuth – If your Outlook client does not support OAuth, you will need to upgrade to the latest version and then setup using Outlook.com Sync. You can either purchase a new Outlook License, use the Outlook that is included in your Microsoft 365 subscription, or download the New Outlook for Windows for free.
The following versions of Outlook Desktop do not support OAuth for Outlook.com: Outlook 2007, Outlook 2010, Outlook 2013, Outlook 2016 MSI, Outlook 2019 LTSC. Any release of Outlook Desktop with a version less than 11601.10000 does not support OAuth for Outlook.com.
Outlook apps are available for free and can be downloaded directly from the Microsoft Store on Windows, the Mac App Store, iOS App Store, or the Google Play Store.
After your download the new email app, add your accounts and they will all be configured to use OAuth and sync properly, helping keep them safe.
If you use Mozilla Thunderbird:
Mozilla Thunderbird does support OAuth and it is recommended that you ensure you switch to use those settings. Any account that you add to Thunderbird will now automatically setup using the proper settings. You have the following options.
Option 1: Update Current Settings
-
Change Thunderbird's server settings:
-
Select ≡ > Account Settings.
-
In the left pane, select Server Settings for your Outlook.com or Hotmail.com account.
-
For Authentication method, select OAuth2 (instead of Normal password).
-
-
Change Thunderbird's authentication method for sending messages (SMTP):
-
Select ≡ > Account Settings.
-
In the left pane, select Outgoing Server (SMTP).
-
In the right pane, select your Microsoft account and then Edit… .
-
For Authentication method, select OAuth2 (instead of Normal password).
-
Select OK to save your changes.
-
Option 2: Remove Current Account and Re-Add
If you remove your current account from Thunderbird and then re-add it, the proper settings will be detected, and you will just need to sign in to be properly configured with OAuth and the proper server settings.
If you use Apple Mail:
Apple Mail supports OAuth by default when you setup the account as Outlook.com. If you use Apple Mail and you are seeing password prompts or connection errors, this is most likely happening because your account got configured as basic auth. To mitigate the issue, remove the account and add it back as Outlook.com.
Remove your account from Apple Mail:
-
Go to Settings > Mail > Accounts.
-
Tap the email account you want to remove from your iPhone, then tap Delete Account. For more information, please go to Add and remove email accounts on iPhone.
Add your account back to Apple Mail:
-
Go to Settings > Mail.
-
Tap Accounts, then tap Add Account.
-
In the Add Account dialog, choose Outlook.com.
If removing and re-adding the account does not address the issue, do the following:
-
Remove the account again.
-
Go to Settings > Safari, then tap Clear History and Website Data.
-
Reboot your iPhone.
-
Add the account back and proceed through the Outlook.com account sign in flow.
If you use another email application:
Always check the add account steps to look for Outlook.com and use it if that option is available. If Outlook.com is not an option, you will want to contact the application's support to confirm that they support OAuth against EAS, POP, IMAP, and SMTP. If they do not, you will be able to continue using Basic Auth until we announce our final deprecation dates. However, you may experience increased login prompts as we work to protect accounts.
As a reminder, all users can download Outlook for free and it works with most email services. Outlook can be downloaded directly from the Microsoft Store on Windows, the Mac App Store, iOS App Store, or the Google Play Store.
For additional support or questions, please refer to the Answer forum thread, Outlook 2016 doesn't accept password or app password .
More Resources
Ask the experts
Connect with experts, discuss the latest Outlook news and best practices, and read our blog.
Get help in the community
Ask a question and find solutions from Support Agents, MVPs, Engineers, and Outlook users.
Suggest a new feature
We love reading your suggestions and feedback! Share your thoughts. We're listening.
