Deprecation of Basic authentication in Exchange Online

If you received an email from UM Information Service and Technology (IST) about this issue, you will need to recreate your email profile before October 1, 2022.

 If you have not received an email from IST, no action is required.

After October 1, 2022, any email applications that connect to Exchange Online mailboxes will need to use Modern authentication or they will be unable to connect.

Many email clients support both basic and modern authentication. Even if your email client supports Modern authentication, you may not be using Modern authentication because your email client remembers how you first setup the account. Therefore, there may still be an issue if you linked to your account using Basic authentication (as was common more than 2 years ago).

Basic authentication simply means the application sends a username and password with every request, and those credentials are also often stored or saved on the device. Traditionally, Basic authentication is enabled by default on most servers or services and is simple to set up.

Simplicity isn't at all bad, but Basic Authentication makes it easier for attackers to capture user credentials, which makes it an outdated industry standard. Modern authentication has many benefits and improvements that help mitigate the issues in Basic authentication.

The following email clients use Modern authentication:

The applications listed below have been identified as “legacy” applications and will no longer work with basic authentication. This is not an exhaustive list:

• Thunderbird (Windows and Mac OS)
• Microsoft Office 2013 or prior (Microsoft Windows)
• Microsoft Office 2011 or prior (Mac OS)
• MacMail (10.13 High Sierra and older)
• Android Mail
• Mail app (iOS 10 and older)

To recreate your email profile, you must remove and re-add your UM email account.

Instructions for Windows

• Remove an email account
• Add an email account

Instructions for Mac and iOS

• How to remove and re-add your email account (PDF)

Instructions for Android

• Add or remove an account on Android

Instructions for Thunderbird email client

Although Thunderbird is not listed by Microsoft as a supported email client, we have found some people are able to successfully authenticate using Modern authentication by changing their profile to use “OAuth2”.  The method can only be set after the profile is created.

After your account profile is created:

1. Go to Account Settings > Server Settings > Security Settings > Authentication Method and select OAuth2 from the Authentication Method drop-down in most recent versions.
2. The other IMAP settings are:
   • Incoming mail server – outlook.office365.com
   • Outgoing mail server – smtp.office365.com
   • Under incoming server IMAP enter – 993 and SSL/TLS
   • Under Outgoing server (SMTP) enter – 587 and STARTTLS