What is basic authentication?
For many years applications have used basic authentication to connect to servers and services. Basic authentication means the application sends a username and password with every request and those credentials are also often stored or saved on the device.
Simplicity isn’t necessarily bad, but basic authentication makes it easier for attackers to capture user credentials, particularly if those credentials aren’t encrypted, increasing the risk of them being used to compromise other services.
In addition, the enforcement of multifactor authentication is sometimes not possible when basic authentication remains enabled.
Basic authentication is now an outdated industry standard and has been replaced by more secure modern authentication, and Microsoft has now taken the decision to disable it completely in M365.
When will it be disabled?
Microsoft has already begun to disable basic authentication for Outlook, POP and IMAP protocols in Exchange Online. They are doing this in stages, so there is no easy way of knowing in advance when it will be disabled in your tenant, however, they envisage by January 1st 2023, all tenants will have had basic authentication access disabled.
How does this affect me?
Basic authentication is generally used by older email clients and devices so if your device is over 3 years old or you have transferred data to a new device by restoring a backup from an old one you may be affected. If mail stops working on your device and it won’t accept your password, this could be a sign that basic authentication has been disabled on your tenant. Both desktop email clients such as Microsoft Outlook and mobile devices e.g iPhones / iPads etc can be affected.
What action do I need to take?
If your device is using basic authentication, then the mail client or settings it uses are now outdated. In order to rectify this simply removing and re-adding your email account on some devices will cause it to switch to modern authentication.
If you are unable to re-add your email account, the likelihood is your email client is outdated and does not support modern authentication. In the case of windows desktop computers upgrading Outlook to the latest version should resolve this. On mobile devices, ensure they are running the latest operating system and email client. Some devices over 3 years old may not be able to be upgraded to a supported version and would therefore need to be replaced.