Ever since we announced our intention to disable Basic Authentication in Exchange Online we said that we would add Modern Auth (OAuth 2.0) support for the IMAP, POP and SMTP AUTH protocols.
Today,...
Updated Jun 30, 2022
Version 6.0
Blog Post
1 MIN READ
Announcing OAuth 2.0 support for IMAP and SMTP AUTH protocols in Exchange Online
Could the Exchange team https://techcommunity.microsoft.com/t5/user/viewprofilepage/user-id/324116 kindly clarify exactly what 'use' of a refresh token means?
It may sound obvious, but the obvious meaning is not how it seems to work.
The specific case is the very common use of SMTP mail-out from a website using (in my case) PHPMailer. There is an initial authentication by Admin to get a refresh token that is then used 'permanently' by PHPMailer OAuth2 to obtain access tokens for each activation by website visitors when they use e.g. a Contact form or by the website itself when it needs to send e.g. an order acknowledgment to a customer.
Well it isn't permanent; such a refresh token expires after 90 days of 'non-use' even though it has been submitted to the on umpteen occasions to the OAuth2 endpoint to get access tokens.
Azure Activity - Signins bounces the expiry with: "The refresh token has expired due to inactivity. The token was issued on {issueDate} and was inactive for {time}. Expected part of the token lifecycle - the user went an extended period of time without using the application, so the token was expired when the app attempted to refresh it."
['issueDate' and 'time' are exactly as shown above]
Could anyone in the Exchange Team elucidate please?