What ever happened to app password in my Microsoft account?

If you have been using multifactor authentication in Microsoft account for a while, you have likely encountered app password. Its sole purpose has been to secure devices and apps that do not support two step authentications (via Microsoft Authenticator app). This includes Outlook desktop app, mail apps for iOS, Android, Xbox 360 to name a few.

It is a long, random string of alphanumeric characters that gets generated as a separate app password for each Microsoft service or device that does not support two-step verification codes. Since it’s a one-time type of setup, once you’ve configured your devices with app password, you can stash it way in a safe place.

If you have attempted to set up new email profile in Outlook recently and have not been able to get past the initial attention phase, no matter how many times you triple checked you credentials – read on.

It turns out Microsoft has phased out app password recently (a couple of months back) and many users with MFA enabled may have gotten caught off-guard. When adding a new Outlook profile, you get caught in a vicious circle without any meaningful feedback. You may get a message box stating that “an encrypted connection to mail server is not available” and “We’re sorry, we couldn’t set up your account automatically…” Manual set up will not work either.

If you attempt to sing in to you Microsoft account you notice that  Security & Privacy section has been updated and notably Additional security verification, where app password section used to reside under is now GONE.

The fix is to have Exchange admin to enable Modern Authentication for Outlook.

What is Modern Authentication?            

Modern Authentication brings Active Directory Authentication Library (ADAL)-based sign-in to Office client apps across platforms. It enables sign-in features such as Multi-Factor Authentication (MFA), SAML-based third-party Identity Providers with Office client applications, smart card and certificate-based authentication, and it removes the need for Outlook to use the basic authentication protocol.  

Here’s how to enable Modern Authentication: Log on as admin (with Global Administrator role)– launchpad – Admin – Show All – Settings – Org settings.

Under Services tab, choose Modern authentication, and in the Modern authentication pane, make sure Enable Modern authentication is selected. Choose Save changes.

Now, you will be setup Outlook profile using the same password you log on to Microsoft account with. MFA authentication is still in force, whether be authenticator app or Text code option.