Auth changes for Outlook 2024 October

[Bilbo47]

Wondering if this MS post is relevant to non-MS clients. So they're changing the MS-only auth method for MSOffice add-ins, which includes Outlook add-ins? Of course they never mention OAuth2 there. Compare against this learning article about doing OAuth for POP+IMAP+SMTP - does registering your app under Entra for OAuth have anything to do with their new auth method for add-ins?

Also this SO article has the screen I got when "registering my own app" for purposes of generating a personal ClientID for adding to prefs, like we did for Ggl OAuth. Not clear if that whole auth scheme for MS is staying or going away.

[athenian200]

Also, testing OAuth at MS would be a decent reason to un-delete from Epyrus my otherwise-unused account at Outlook.com

Yeah, that would be a big help, actually that is one of the big things that has been holding up the next release of Epyrus. I'm trying to figure out how to get OAuth2 to work with Microsoft services. It's a particularly pressing problem for me, because I've found myself in the unfortunate situation of basically all three of the main e-mail accounts I use being tied to Microsoft services. My personal outlook.com one still works fine with Epyrus for now, but the one I use for school and the other I use for another service are all based on Microsoft. Two of those I don't even really get to pick, but my personal outlook.com one being my go-to is technically my fault, a legacy of my Windows 8 and Lumia 920 days that I never bothered to change.

I am pretty desperate to get OAuth2, NAA, or pretty much anything else working with this because until I do, Epyrus will be almost unusable for me after September. I'm going to do another point release soon, just because I think we're way overdue for a security update, but as far as any forward momentum on bugfixes or anything like that, I haven't really done anything.

[back2themoon]

I'm guessing Microsoft doesn't provide the 2FA/app password workaround as Google does?

[athenian200]

I'm guessing Microsoft doesn't provide the 2FA/app password workaround as Google does?

As far as I know, the app password thing is Google only. Other providers adopting OAuth2 later on don't seem to be offering that, or at least it's not clear to me how to activate it if they do.

[Lootyhoof]

I'm guessing Microsoft doesn't provide the 2FA/app password workaround as Google does?

As far as I know, the app password thing is Google only. Other providers adopting OAuth2 later on don't seem to be offering that, or at least it's not clear to me how to activate it if they do.

The Microsoft information you require is here, FWIW.

[Moonchild]

The Microsoft information you require is here, FWIW.

Thanks!

I've created an app password after enabling 2FA (since that's a requirement). According to the info Microsoft gives, that should remain working despite their wanting to use OAuth2 everywhere instead.

[Bilbo47]

the app password thing is Google only

Yahoo actually provides the same thing, under the name "Secure Mail Keys".

[Bilbo47]

created an app password after enabling 2FA (since that's a requirement). that should remain working despite their wanting to use OAuth2

Same and agree. This means Outlook.com does *not* urgently require OAuth in Epyrus. Rather, it is a nice-to-have future feature.

[gabrgv]

This means Outlook.com does *not* urgently require OAuth in Epyrus.

It does in my case, since to create an app password you are required to enable 2FA, for which you need a smartphone.

[Moonchild]

for which you need a smartphone.

I'm pretty sure they also allow you to generate offline codes for it. i.e. a bunch of one-use codes you use and strike off.
Alternatively you can emulate a smartphone and use an authenticator app on the emulation.

[back2themoon]

It does in my case, since to create an app password you are required to enable 2FA, for which you need a smartphone.

Unless they require a specific app, a smartphone is not essential for 2FA. You can use KeePassXC for example to generate TOTP passwords.

[Moonchild]

You can use KeePassXC for example to generate TOTP passwords.

Oh, there are native applications that can be used instead? I wasn't aware of that. I thought you were kinda stuck with using a TOTP app on mobile.

[back2themoon]

Yes, I use it for all kinds of 2FA codes - Google included. No doubt other desktop software can do it, too.

[RealityRipple]

<Shameless self-promotion>https://realityripple.com/Software/Applications/SecondFactor/</Shameless self-promotion>

[back2themoon]

Nice one, RealityRipple. Thanks, will check it out.

[Moonchild]

Awesome! Consider that a valuable addition to my software collection

[Keith Moon]

I don't know how related this is, but I find that there is are a number of times that it takes Epyrus (but also other older mail clients) to connect to Outlook.com accounts. Initially, there will be several prompted retries, but after eight to ten attempts at logging in, the client finally connects and retrieves mail over IMAP.

[UCyborg]

You can use KeePassXC for example to generate TOTP passwords.

Oh, there are native applications that can be used instead? I wasn't aware of that. I thought you were kinda stuck with using a TOTP app on mobile.

Yes, I use the original KeePass 2, a .NET app for Windows, but works on other systems via Mono (Linux...), though GUI doesn't look native there (so KeePassXC was made).

They're both password managers working with a local database, the only thing missing is a XUL extension that would not only get user name and password from user's database, but TOTP code as well. KeePassXC-Browser works very well on Chromium and Firefox. KeePassXC-Browser can work with both KeePassXC and KeePass 2 (the latter with appropriate plugin).

[moonbat]

For Linux there's keepass-xc available from the repo for most distros.

[back2themoon]

I don't know how related this is, but I find that there is are a number of times that it takes Epyrus (but also other older mail clients) to connect to Outlook.com accounts. Initially, there will be several prompted retries, but after eight to ten attempts at logging in, the client finally connects and retrieves mail over IMAP.

Don't know about outlook.com, but Yahoo accounts require an advanced settings change to work reliably. You could try it:

Account Settings/Server Settings/Advanced.../Maximum number of server connections to cache. The default is 5 I think. Set it to 2.