Modern Authentication, defined simply
Modern Authentication is Microsoft's name for OAuth 2.0 sign-in: instead of a mail client sending your password to the server (Basic Authentication), you log in on Microsoft's own secure page, and Microsoft hands the client a limited, revocable access token. Your password never passes through the third-party app.
Why it's required now
It isn't new - Microsoft added OAuth for IMAP, POP, and SMTP in 2020 - but Microsoft has been switching password sign-in off. Personal Outlook.com, Hotmail, Live, and MSN accounts lost Basic Authentication, app passwords included, on September 16, 2024, so Modern Authentication is the only way an outside app can sign in to them. Microsoft 365 work and school accounts lost it for reading mail over IMAP and POP starting October 1, 2022.
The last piece: Microsoft 365 sending
Microsoft 365 sending (SMTP AUTH) still accepts a password where an organization allows it. Microsoft plans to switch that off by default for existing organizations at the end of December 2026; admins can turn it back on for a while, and Microsoft plans to announce a final removal date in the second half of 2027. After that, Modern Authentication covers everything.
What this means for your client
A client that only offers a username-and-password form can't connect to a personal Outlook.com account or read Microsoft 365 mail, however correctly you fill it in. It has to support signing in with Microsoft directly.
The fix: sign in with Microsoft
- Look for a 'Sign in with Microsoft' or OAuth option in your mail client's account setup, rather than a plain password field.
- In Curo, choose to connect an Outlook.com or Microsoft 365 account.
- Click 'Sign in with Microsoft' and complete the login on Microsoft's own secure page.
- Approve the requested permissions.
- Curo connects using Modern Authentication, so this is a one-time step - triage starts right after.