Microsoft 365 and Outlook

Microsoft no longer accepts a password over IMAP for Outlook.com and Microsoft 365 mailboxes. So a Microsoft mailbox connects in one of two ways:

• Microsoft sign-in, when your instance offers it. You approve access once, and opendesk reads the mailbox and sends replies through it. See Microsoft sign-in.
• Forwarding. Microsoft passes incoming mail on to a private opendesk address. Replies go out through opendesk, or through Microsoft’s SMTP server when your admin allows SMTP AUTH.

When Microsoft sign-in isn’t offered, the wizard says so and recommends forwarding.

1. Microsoft 365, found from the domain’s MX records. Outlook.com, Hotmail and Live addresses show as Outlook.com.
2. Why forwarding: Microsoft turned off password sign-in over IMAP.
3. Forward mail to opendesk, recommended. Other IMAP and SMTP stays available for other servers.

Connect by forwarding

1. Add the mailbox and pick forwarding

   In Settings, open Mailboxes and click Add mailbox. Type a name and the address, keep Forward mail to opendesk selected and click Continue.

2. Choose how replies are sent

   • Through opendesk: replies come from opendesk’s sending address with your mailbox’s name, and the customer’s answers come back to your address. Nothing to set up.
   • Through your SMTP server: replies come from your address itself, through smtp.office365.com on port 587 with STARTTLS. This needs SMTP AUTH turned on for the mailbox (see Turn on SMTP AUTH).

   

   To send through Microsoft, choose Through your SMTP server. The server, port and security are filled in; type the mailbox’s password and click Connect. opendesk signs in to the SMTP server before it saves anything.

   

3. Copy the forwarding address

   After you click Create mailbox (or Connect), the last step shows the private address to forward to, with a copy button, and the steps for Microsoft 365. You can find both again on the mailbox’s page.

   

4. Forward the mail in Microsoft

   As an admin, in the Exchange admin center, open Recipients, Mailboxes and select the mailbox. Under Mail flow settings, choose Manage email forwarding, turn on forwarding, paste the address and keep Deliver to both on if the mailbox should keep a copy. Without admin rights, use an Outlook rule instead. Forwarding has both, step by step.

5. Allow forwarding to outside addresses

   Microsoft 365 blocks automatic forwarding to outside addresses by default. An admin allows it in the Microsoft Defender portal: Email & collaboration, Policies & rules, Threat policies, Anti-spam policies. Open the outbound policy (or create one for the support mailbox only) and set Automatic forwarding rules to On - Forwarding is enabled.

   Then write to the address from another account. The email shows up in Unassigned as a new ticket.

Turn on SMTP AUTH

Sending replies through Microsoft’s SMTP server needs SMTP AUTH (authenticated SMTP) for the mailbox. Many organizations keep it off. An admin turns it on for one mailbox:

1. Open the user in the Microsoft 365 admin center

   In the Microsoft 365 admin center, open Users, Active users, and select the user for the support address.

2. Allow Authenticated SMTP

   On the Mail tab, choose Manage email apps, tick Authenticated SMTP and click Save changes. It can take up to an hour to apply.

The same in Exchange Online PowerShell:

Set-CASMailbox -Identity support@contoso.com -SmtpClientAuthenticationDisabled $false

Note

• The per-mailbox setting wins over the organization’s default, under Settings, Mail flow in the Exchange admin center.
• Security defaults in Microsoft Entra, and Conditional Access policies that block legacy sign-in, refuse a password over SMTP for the whole organization. Turning SMTP AUTH on for the mailbox doesn’t change that.
• The account signs in with its password alone: an account that asks for multi-factor sign-in can’t send this way.
• Microsoft is phasing out password sign-in for SMTP AUTH in Exchange Online. When your organization no longer accepts it, send replies through opendesk.

If your admin keeps SMTP AUTH off, choose Through opendesk.

If Microsoft refuses the sign-in

Nothing is saved when Microsoft refuses. The wizard shows the cause and the fix, with Microsoft’s own reply underneath.

What you see	What to do
SMTP sign-in is turned off in Microsoft 365	Turn on SMTP AUTH for the mailbox, as above, or send replies through opendesk.
Microsoft security defaults block passwords	Security defaults refuse passwords over SMTP and IMAP. Connect with Microsoft sign-in, or forward and send through opendesk.
A Microsoft sign-in policy blocked this	A Conditional Access policy refused the password. Connect with Microsoft sign-in, forward the mail, or ask your admin to allow SMTP AUTH for this mailbox.
Microsoft needs Microsoft sign-in	Exchange Online doesn’t accept a password over IMAP. Connect with Microsoft sign-in, or by forwarding.
Microsoft did not accept the password	Check the address and password, including the sign-in address if it differs from the mailbox address. An account with multi-factor sign-in can’t use a password here.

Microsoft sign-in, when your instance offers it

When your instance offers Microsoft sign-in for mailboxes, Sign in with Microsoft is the recommended way for Microsoft 365 and Outlook.com. opendesk reads the mailbox over IMAP and sends replies through Microsoft, so they land in its Sent folder. No password is stored.

1. Pick Sign in with Microsoft

   Add the mailbox, type the address, keep Sign in with Microsoft selected and click Continue.

   

2. Approve access in Microsoft

   Click Continue with Microsoft, pick the Microsoft account for the address and accept the permissions. Microsoft sends you back to opendesk with the mailbox connected.

   Some organizations require an admin to approve new apps. If you see Need admin approval, ask a Microsoft 365 admin to grant consent for opendesk.

What opendesk asks for

Scope	Why
openid, email	Identify which Microsoft account was connected.
offline_access	Keep the connection working after you close the browser.
https://outlook.office.com/IMAP.AccessAsUser.All	Read incoming mail over IMAP (outlook.office365.com).
https://graph.microsoft.com/Mail.Send	Send replies through the mailbox.
https://graph.microsoft.com/User.Read	Read the account’s basic profile.

Tokens are encrypted at rest with AES-GCM.

IMAP must be enabled

In Microsoft 365, IMAP can be turned off per mailbox. An admin turns it on in the Microsoft 365 admin center under Users, Active users: select the user, then Mail, Manage email apps, and tick IMAP.

Self-hosting

On your own instance, Microsoft sign-in for mailboxes needs your own Microsoft app (MICROSOFT_CLIENT_ID and MICROSOFT_CLIENT_SECRET), and MICROSOFT_MAILBOX_OAUTH turns it on or off for new mailboxes. See Google and Microsoft OAuth and Mailbox sign-in.

Disconnect

Remove the mailbox in opendesk, under Mailboxes. Then, at Microsoft:

• Forwarding: turn off the forwarding or the Outlook rule, so mail stops going to the old address.
• SMTP: change the mailbox’s password, or turn SMTP AUTH off again.
• Microsoft sign-in: remove opendesk from My apps, or as an admin from Enterprise applications in Microsoft Entra.

Related

• Connect a mailbox
• Forwarding
• Other providers