Microsoft is making some progress to convince customers to disable basic authentication for protocols they never use, and has upgraded older protocols like POP3 and IMAP4 to use OAuth 2.0 for modern authentication. Largely because of history, Exchange Online supports a wide variety of connectivity protocols. Update (November 15, 2022): Three ways are available to send email using the Graph. It’s therefore wise to be considering how you will replace this protocol in production when that time comes. For now, Microsoft is focusing on removing basic authentication for protocols like IMAP4 and POP3, but they will come back to remove basic authentication for SMTP AUTH.

Update (September 25, 2021): Microsoft’s latest plan to decommission basic authentication for email connection protocols excludes SMTP AUTH. Moving to modern authentication and protecting as many accounts as possibly with multi-factor authentication (especially administrator accounts as mandated by Azure AD Security Defaults) are the right steps to take. This is a big problem because hackers continue to compromise Office 365 accounts and tenants with techniques like password spray attacks. Use an Application Access Policy to Restrict Mailboxes Used by the AppĪs discussed before, Microsoft bangs the drums loudly about the need to stop using basic authentication and start using modern authentication.Converting PowerShell Scripts from Send-MailMessage.

Exchange online modern authentication