The old method is gone
For years, third-party clients connected to Outlook.com or Microsoft 365 like any IMAP mailbox: your email address and a password, or an app password if two-factor was on. That method is called Basic Authentication. Microsoft turned it off for personal Outlook.com, Hotmail, Live, and MSN accounts on September 16, 2024, app passwords included, and for reading mail over IMAP and POP on Microsoft 365 work and school accounts starting October 1, 2022.
OAuth is the way in
What works is OAuth 2.0, which Microsoft calls Modern Authentication. In practice the client has to offer a 'Sign in with Microsoft' button that takes you to Microsoft's own login page, rather than a plain username and password form. The one leftover is Microsoft 365 sending (SMTP AUTH), which still accepts passwords until Microsoft switches it off by default at the end of December 2026, so a client that reads with OAuth but sends with a password is living on borrowed time.
Not every client has caught up
Older or simpler mail clients built only for password-based IMAP login can't connect to Outlook.com at all, and can't read Microsoft 365 mail, until they add Microsoft sign-in. Checking that a client explicitly offers 'Sign in with Microsoft' is the fastest way to know it will work.
The fix: sign in with Microsoft
- Skip any setup screen that asks for an Outlook.com/Microsoft 365 password or app password directly.
- In Curo, choose to add an Outlook.com or Microsoft 365 account.
- Select 'Sign in with Microsoft' and complete the login on Microsoft's own page.
- Approve the permission request Microsoft shows you.
- Your account connects over OAuth, and Curo begins triaging your Outlook mail alongside anything else you've connected.