How to Use XOAUTH2 with IMAP, POP, or SMTP for Mail Servers
Question details
The user needs to configure XOAUTH2 authentication to connect an application to Microsoft or Gmail mail servers via IMAP, POP, or SMTP protocols.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Setting up modern OAuth authentication for an application to securely access email services.
- Observed behavior
- Basic authentication with Outlook or Gmail server settings fails, as the mail servers now require XOAUTH2 for successful connections.
Ensure you have administrative access to your Microsoft Entra ID (formerly Azure Active Directory) portal to register the application and generate the required OAuth credentials.
Register the Application with Microsoft Entra ID
Configure OAuth authentication by registering your application with Microsoft's identity platform to securely connect via IMAP, POP, or SMTP.
Since Microsoft and Google have deprecated basic authentication, applications must use modern authentication (OAuth 2.0). By registering your application in Microsoft Entra ID, you can obtain the necessary access tokens to authenticate via the XOAUTH2 protocol.
Navigate to the Microsoft Azure portal and open the Microsoft Entra ID (formerly Azure Active Directory) service.
Click on 'App registrations' in the left menu, select 'New registration', and enter a name for your IMAP/POP/SMTP application.
Go to 'API permissions', click 'Add a permission', and select Microsoft Graph or Office 365 Exchange Online. Add the delegated permissions required for your protocol, such as IMAP.AccessAsUser.All, POP.AccessAsUser.All, or SMTP.Send.
Navigate to 'Certificates & secrets' and create a new client secret. Save this value securely, as your application will need it to request OAuth tokens.
Update your application code to use the Microsoft Authentication Library (MSAL) to retrieve an access token. Pass this token to your mail server using the standard XOAUTH2 authentication format.
Enhance Your Workflow with WPS Office
While managing complex backend configurations like XOAUTH2 email authentication, keep your document workflows simple and efficient. WPS Office provides a lightweight, fully functional suite for all your document, spreadsheet, and presentation needs without the heavy cost.
Frequently Asked Questions
What is XOAUTH2 and why do I need it for IMAP or SMTP?
XOAUTH2 is an authentication protocol mechanism that uses OAuth 2.0 access tokens instead of traditional username/password credentials. You need it because major email providers like Microsoft and Google are disabling basic authentication to improve security.
Can I use XOAUTH2 with personal Gmail accounts?
Yes, Google supports XOAUTH2 for Gmail. Instead of Microsoft Entra ID, you must register your application in the Google Cloud Console, create OAuth 2.0 Client IDs, and request the appropriate Gmail API scopes.
Why does my application fail to authenticate even after generating an OAuth token?
Authentication failures often occur if the generated token lacks the correct API scopes (like SMTP.Send), if the token has expired without a refresh token mechanism in place, or if the XOAUTH2 string isn't formatted correctly (base64 encoded containing the user address and bearer token).
