| At line 1 added 3 lines |
| !Microsoft Mail integration\\ |
| ---- |
| !1. Microsoft App Passwords\\ |
| At line 2 changed one line |
| !1. Microsoft SMTP via OAuth 2.0 \\ |
| __⚠️ Constraints__: __It is only supported for accounts with 2-Step Verification enabled.__\\ |
| At line 4 changed one line |
| Traditionally, __SMTP__ authentication with Microsoft services (like Outlook or Microsoft 365) used username and password. However, Microsoft now strongly recommends (and in many cases enforces) the use of __OAuth 2.0__ for authentication, especially for enhanced security and compliance.\\ |
| Microsoft App Passwords are special 16-character passwords used for apps that don’t support two-factor authentication (2FA). They are required when 2FA is enabled on your Microsoft account and you’re using legacy applications (like old email clients). You can generate and manage them from your Microsoft security settings at __account.microsoft.com/security__.\\ |
| At line 9 added 62 lines |
| Service can use __App Passwords__:\\ |
| __SMTP__: smtp.office365.com\\ |
| __IMAP__: imap-mail.outlook.com\\ |
| __POP3__: pop-mail.outlook.com\\ |
| ---- |
| \\ |
| __1.1 Microsoft Personal Accounts__ (@outlook.com, @hotmail.com, etc.):\\ |
| 🔴 App Passwords do not work with SMTP/IMAP/POP for these accounts anymore. __⚠️ Microsoft has deprecated basic auth for personal accounts__.\\ |
| \\ |
| ---- |
| __1.2 Microsoft 365 (work or school) accounts__:\\ |
| \\ |
| For Microsoft 365 (work or school) accounts, __App Passwords__ and __Multi-Factor Authentication (MFA)__ are managed centrally by your organization through __Microsoft Entra ID (formerly Azure Active Directory)__ — not through the personal Microsoft account portal.\\ |
| \\ |
| __How to enable App Passwords:__:\\ |
| • Go to the legacy __MFA portal__: [MultifactorVerification Link|https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx] (Admin user)\\ |
| • Click on the __Service settings__ tab.\\ |
| • Enable the flag: __Allow users to create app passwords to sign in to non-browser apps__\\ |
| [SMTP Microsoft Graph XOAUTH 2 Integration/microsoft_enable_app_password.png]\\ |
| \\ |
| __Check App Password Availability:__\\ |
| a. Go to: [Security info Link| https://mysignins.microsoft.com/security-info]\\ |
| b. Sign in with your work or school email\\ |
| c. Follow the prompts to configure MFA using:\\ |
| • Microsoft Authenticator app (recommended)\\ |
| • Phone call or SMS (if permitted by your organization’s policy)\\ |
| d. If enabled by your admin, click on __+Add sign-in method__ button and you will see an __App passwords__ link in the menu to generate one:\\ |
| [SMTP Microsoft Graph XOAUTH 2 Integration|microsoft_app_password.png]\\ |
| e. If you don’t see the __App passwords__ option: |
| Check and enforce MFA:\\ |
| • Go to [MultifactorVerification Link|https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx] (Admin user)\\ |
| • Find the target user.\\ |
| • In the __MFA Status__ column, confirm it says: __Enforced__. Otherwise, enable __MFA__.\\ |
| \\ |
| __Check if Security Defaults are enabled:__\\ |
| __App Passwords__ will not work if __Microsoft Entra ID Security Defaults__ are __enabled__ for your __tenant__.\\ |
| To disable them:\\ |
| • Go to the Microsoft Entra admin portal [Microsoft EntraLink|https://entra.microsoft.com] (Admin user)\\ |
| • Navigate to: __Identity > Overview > Properties__ Scroll down to Security Defaults and click __Manage security defaults__\\ |
| •Select Disable, then click Save. __Changes may take 5–10 minutes to take effect.__\\ |
| [SMTP Microsoft Graph XOAUTH 2 Integration|microsoft_security_details.png]\\ |
| [SMTP Microsoft Graph XOAUTH 2 Integration|tenant_security_defaults.png]\\ |
| \\ |
| 🔴 __Error message__ like:\\ |
| {{{Authentication unsuccessful, user is locked by your organization's security defaults policy. Contact your administrator.}}} |
| This indicates that your Microsoft 365 tenant has __Security Defaults__ enabled, which blocks __App Passwords__ completely, even if they were created successfully. Disable Security Defaults (if you’re the admin) [Microsoft Entra Link|https://entra.microsoft.com]. __Identity -> Overview -> Properties -> Manage security defaults__ \\ |
| \\ |
| ---- |
| \\ |
| Usage:\\ |
| {{{ |
| Username: your_email@outlook.com |
| Password: [your generated app password] |
| }}}\\ |
| \\ |
| ---- |
| __⚠️ Note__: Microsoft strongly recommends modern authentication (__OAuth 2.0__) instead of app passwords. Some tenants block app passwords entirely for security reasons.\\ |
| ---- |
| \\ |
| !2. Microsoft Mail via OAuth 2.0 \\ |
| Traditionally, __SMTP__/__IMAP__ authentication with Microsoft services (like Outlook or Microsoft 365) used username and password. However, Microsoft now strongly recommends (and in many cases enforces) the use of __OAuth 2.0__ for authentication, especially for enhanced security and compliance.\\ |
| \\ |
| At line 8 changed 4 lines |
| __!!! Proxy Configuration:__ If your server accesses the internet through a proxy, make sure to whitelist the following domains to allow authentication:\\ |
| • login.microsoftonline.com\\ |
| This requires a __Microsoft Graph__ application registration. Start by visiting the Microsoft Azure portal: |
| [Link|https://azure.microsoft.com/en-us/features/azure-portal/]\\ |
| __⚠️ Proxy Configuration:__ If your server accesses the internet through a proxy, make sure to whitelist the following domains to allow authentication: __login.microsoftonline.com__\\ |
| This requires a __Microsoft Graph__ application registration.\\ |
| At line 76 added 2 lines |
| Start by visiting the __Microsoft Azure Portal__: [Link|https://azure.microsoft.com/en-us/features/azure-portal/]\\ |
| \\ |
| At line 17 changed one line |
| The Redirect URL must end with __register_microsoft_graph_api/__.\\ |
| In the Redirect URI section, for Platform configuration, select __Web__. The Redirect URL must end with __register_microsoft_graph_api/__.\\ |
| At line 20 removed one line |
|
| At line 22 changed 5 lines |
|
| }}}\\ |
| or |
| {{{ |
| |
| or |
| At line 28 removed one line |
| |
| At line 31 changed one line |
| __Secret key:__ A new client secret must be created. Go to __Certificates & secrets__, and generate a new client secret by clicking on __New client secret__. Ensure you copy over the __value__ immediately!\\ |
| __Secret key:__ A new client secret must be created. Go to __Certificates & secrets__, and generate a new client secret by clicking on __New client secret__. ⚠️ Ensure you copy over the __value__ immediately!\\ |
| At line 46 changed one line |
| __!!!Warning__: Make sure that the user's __SMTP AUTH__ is enabled, otherwise SMTP authentication will fail. You can view the official documentation here: [Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online|https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission].\\ |
| __⚠️ Warning__: Make sure that the user's __SMTP AUTH__ is enabled, otherwise SMTP authentication will fail. You can view the official documentation here: [Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online|https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission].\\ |
| At line 48 changed one line |
| __Note__: XOAUTH authentication requires user-delegated permissions, meaning the user must be a real, licensed user with authentication capabilities (i.e., they must have a valid product license and be able to sign in).\\ |
| __Note__: OAuth 2.0 authentication requires user-delegated permissions, meaning the user must be a real, licensed user with authentication capabilities (i.e., they must have a valid product license and be able to sign in).\\ |
| At line 51 changed 2 lines |
| !!!SMTP settings\\ |
| \\ |
| ---- |
| !3. SMTP settings\\ |
| At line 60 changed 2 lines |
| __SMTP Server Username, Password__: If the SMTP server address contains __office365__ or __outlook__, the corresponding __Get Refresh Token__ button will appear. Click that button to proceed.\\ |
| __!!! Note__: To obtain the __Refresh Token__, the CrushFTP WebInterface’s host and port must match the __Redirect URL__ specified in the __Azure App Registration__. In our example, it was: http://localhost:9090 or https://your.crushftp.domain.com/\\ |
| __SMTP Server Username, Password__:\\ |
| ---- |
| __a.)__ __App passwords__: [Microsoft App Passwords Link|https://www.crushftp.com/crush11wiki/Wiki.jsp?page=SMTP%20Microsoft%20Graph%20XOAUTH%202%20Integration#section-SMTP+Microsoft+Graph+XOAUTH+2+Integration-1.MicrosoftAppPasswords]\\ |
| {{{ |
| SMTP Server Username: your_email@outlook.com |
| SMTP Server Password: [your generated app password] |
| }}}\\ |
| ---- |
| __b.)__ __OAuth 2.0__: [Microsoft Mail via OAuth 2.0 Link|https://www.crushftp.com/crush11wiki/Wiki.jsp?page=SMTP%20Microsoft%20Graph%20XOAUTH%202%20Integration#section-SMTP+Microsoft+Graph+XOAUTH+2+Integration-2.MicrosoftMailViaOAuth2.0]\\ |
| If the SMTP server address contains __office365__ or __outlook__, the corresponding __Get Refresh Token__ button will appear. Click that button to proceed.\\ |
| __⚠️ Note__: To obtain the __Refresh Token__, the CrushFTP WebInterface’s host and port must match the __Redirect URL__ specified in the __Azure App Registration__. In our example, it was: http://localhost:9090 or https://your.crushftp.domain.com/\\ |
| At line 68 changed one line |
| __!!! Note__: Be sure to sign in with the __Microsoft Account__ that has the __necessary permissions__, as configured in the Azure App Registration mentioned above.\\ |
| __⚠️ Note__: Be sure to sign in with the __Microsoft Account__ that has the __necessary permissions__, as configured in the Azure App Registration mentioned above.\\ |
| At line 71 changed one line |
| __From email address__: You must also specify the __From__ email address. __!!! Important__ The __From__ address must exactly match __the signed-in Microsoft user’s email address__ (i.e., the account used to obtain the refresh token). Otherwise, SMTP authentication will fail.\\ |
| __From email address__: You must also specify the __From__ email address. __⚠️ Important__ The __From__ address must exactly match __the signed-in Microsoft user’s email address__ (i.e., the account used to obtain the refresh token) or the account associated with the App Password. Otherwise, SMTP authentication will fail.\\ |
| At line 77 changed one line |
| !!!PopImapTask |
| ---- |
| !4. PopImapTask\\ |
| At line 84 changed one line |
| smtp.office365.com |
| outlook.office365.com |
| At line 88 changed one line |
| __!!! Note__: To obtain the Refresh Token, the CrushFTP WebInterface’s host and port must match the Redirect URL specified in the Azure App Registration. In our example, it was: http://localhost:9090 or https://your.crushftp.domain.com/\\ |
| __Mail Username, Password__:\\ |
| ---- |
| __a.)__ __App passwords__: __⚠️ Constraints__: __It is only supported for accounts with 2-Step Verification enabled.__\\ [Microsoft App Passwords Link|https://www.crushftp.com/crush11wiki/Wiki.jsp?page=SMTP%20Microsoft%20Graph%20XOAUTH%202%20Integration#section-SMTP+Microsoft+Graph+XOAUTH+2+Integration-1.MicrosoftAppPasswords]\\ |
| {{{ |
| Mail Username: your_email@outlook.com |
| Mail Password: [your generated app password] |
| }}}\\ |
| ---- |
| __b.)__ __OAuth 2.0__: Configure the __App registration__. See at [Microsoft Mail via OAuth 2.0|https://www.crushftp.com/crush11wiki/Wiki.jsp?page=SMTP%20Microsoft%20Graph%20XOAUTH%202%20Integration#section-SMTP+Microsoft+Graph+XOAUTH+2+Integration-1.MicrosoftMailViaOAuth2.0]\\ |
| At line 167 added 2 lines |
| __⚠️ Note__: To obtain the Refresh Token, the CrushFTP WebInterface’s host and port must match the Redirect URL specified in the Azure App Registration. In our example, it was: http://localhost:9090 or https://your.crushftp.domain.com/\\ |
| \\ |
| At line 92 changed one line |
| __!!! Note__: Be sure to sign in with the __Microsoft Account__ that has the __necessary permissions__, as configured in the Azure App Registration mentioned above.\\ |
| __⚠️ Note__: Be sure to sign in with the __Microsoft Account__ that has the __necessary permissions__, as configured in the Azure App Registration mentioned above.\\ |
| At line 102 changed one line |
| More info: [Link| https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CrushTask#section-CrushTask-POP3IMAP]\\ |
| ---- |
| For more information, see the general POP/IMAP Task description: [POP/IMAP Task – CrushFTP Documentation Link| https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CrushTask#section-CrushTask-POP3IMAP]\\ |
| ---- |
