Blog Post

Exchange Team Blog
1 MIN READ

Announcing OAuth 2.0 Client Credentials Flow support for POP and IMAP protocols in Exchange Online

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Jun 30, 2022

Today, we’re excited to announce the availability of OAuth 2.0 authentication via client credentials grant flow for the POP and IMAP protocols for accessing Exchange Online mailboxes.

Applications that need to access Exchange Online mailboxes without user interaction and using the identity of the application as opposed to user identity are now supported. This is enabled by using service principals in Exchange and mailbox permissions. While no user interaction is needed, Exchange Online admins will need to provide specific mailbox access (using Exchange Online PowerShell) for applications’ service principals to access the mailboxes.

How it works

Once an admin has granted consent to an Azure Active Directory application, they must register the application’s service principal in Exchange Online. This is done using the new Exchange Online PowerShell cmdlet, New-ServicePrincipal (this cmdlet is currently rolling out).

Once the application’s service principal is registered in Exchange Online, the admin can give the application access to specific mailboxes using the Add-MailboxPermission cmdlet. The application can then authenticate POP and IMAP connections to the Exchange Online mailboxes.

The OAuth 2.0 client credentials grant flow can be used to generate access tokens, which can be used as the authentication token in SASL XOAUTH2 format for POP and IMAP connections to Exchange Online mailboxes.

You can follow these step-by-step instructions on how to implement client credentials flow support for POP and IMAP in your application.

Exchange Online Team

Updated Jun 30, 2022
Version 2.0
announcements
development
exchange online
security

55 Comments

Sort By
Show More
  • JNeck's avatar
    JNeck
    Copper Contributor
    Jul 14, 2022

    Very very good news! Thank you very much!

    We still need non-interactive access via credential flow for SMTP too.

    Will this function be implemented?

    Is there already any timeframe for this?

     

    Thanks in advance!

  • Greg Taylor - EXCHANGE's avatar
    Greg Taylor - EXCHANGE
    Icon for Microsoft rankMicrosoft
    Jul 12, 2022

    ViliusS - not yet. 

    pantherfan69 - yes Eric, OAuth flows and constructs require much more developer skills - but unfortunately the increase in attacks using basic auth has meant we have to move on. It's not just Exchange, it's an industry trend. 

  • pantherfan69's avatar
    pantherfan69
    Copper Contributor
    Jul 05, 2022

    Thanks for the information, I would like to stress that most of the documentation for this stuff is developer oriented, while most of the people using mail flows for applications are NOT developers.  Trying to walk a non-developer through getting an access token for Oauth grant flows, instead of just filling out the username/password fields in a nice gui that worked for years is proving to be VERY problematic.

     

    I applaud increasing security, however I must state how much more of a burden this puts on admins as the usability factor on this new method is beyond awful.  I am very surprised that this went forward after 2 years of being on hold, without improvements to the user interaction experience.  Also, you may want to emphasize the user of the offline permissions so people dont end up having to request new token constantly.

     

     

  • ViliusS's avatar
    ViliusS
    Brass Contributor
    Jul 02, 2022

    Cool, any news on credentials flow support for SMTP?