Fix JavaMail IMAP XOAUTH2 Authentication Failed on Microsoft 365
Question details
Users receive an 'AR1 NO AUTHENTICATE failed' error when attempting to connect to Microsoft 365 via IMAP over SSL using JavaMail and XOAUTH2.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- A Java application using JavaMail 1.6.2 is trying to authenticate with a Microsoft 365 email account over port 993 utilizing modern OAuth 2.0 (XOAUTH2) but fails during the authentication phase.
- Observed behavior
- The connection to outlook.office365.com is successfully established, but the Exchange server rejects the authentication token, resulting in the failure message 'AR1 NO AUTHENTICATE failed'.
Ensure you have global administrator access to the Microsoft 365 Admin Center and Microsoft Entra ID (formerly Azure AD) to verify application permissions and mailbox settings.
Verify OAuth Access Token and Microsoft Entra ID Scopes
Ensure your registered application has the correct API permissions and that the token being passed to JavaMail is valid and not expired.
Microsoft 365 requires specific delegated permissions for an application to access IMAP mailboxes via XOAUTH2. If the token lacks these scopes or has expired, Exchange Online will reject the authentication.
Log into the Microsoft Entra ID portal, navigate to 'App registrations', and select your application.
Click on 'API permissions' in the left menu. Ensure that the 'IMAP.AccessAsUser.All' delegated permission is added under Office 365 Exchange Online or Microsoft Graph.
If the permission status indicates it needs consent, click 'Grant admin consent for [Your Organization]' to apply the permissions globally.
In your Java code, verify that you are requesting a fresh OAuth2 access token immediately before initiating the JavaMail connection, as tokens typically expire after 60 minutes.
Enable IMAP Access for the Microsoft 365 Mailbox
Confirm that the specific user mailbox has IMAP enabled, as Microsoft disables legacy protocols by default on newer tenants.
Correct the JavaMail Properties Configuration
Configure your JavaMail properties properly so that it attempts to use XOAUTH2 instead of falling back to legacy basic authentication.
Need a Reliable and Lightweight Office Suite? Try WPS Office
While you are busy troubleshooting backend Exchange authentication, you may need a reliable desktop office suite for your daily document tasks. WPS Office is a high-performance, lightweight, and completely free alternative to Microsoft Office.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Software: Run the lightweight installer to quickly set up WPS Office on your computer.
- 3. Open Your Documents: Double-click any Microsoft Word, Excel, or PowerPoint file to open and edit it directly in WPS Office without formatting issues.
Frequently Asked Questions
What does 'AR1 NO AUTHENTICATE failed' mean in JavaMail?
This error means the connection to the IMAP server was established successfully, but the server rejected the provided credentials or access token. When using XOAUTH2, it typically indicates that the token is expired, invalid, or lacks the necessary API permissions (scopes) in Microsoft Entra ID.
Which API scopes are required for Microsoft 365 IMAP OAuth2?
To authenticate via IMAP using XOAUTH2, your application needs the 'https://outlook.office.com/IMAP.AccessAsUser.All' permission. This must be granted in the Microsoft Entra ID portal under API permissions.
Does JavaMail 1.6.2 support modern authentication (OAuth2)?
Yes, JavaMail versions 1.5.5 and newer, including 1.6.2, natively support the XOAUTH2 authentication mechanism for IMAP, POP3, and SMTP protocols without needing external extensions.
Why is my valid access token still being rejected by Exchange Online?
Even with a valid token, authentication will fail if the target mailbox has IMAP disabled in the Microsoft 365 Admin Center, or if Conditional Access policies (like restricting sign-ins from certain IP addresses) are blocking the connection.
