What actually happened
An app password is a form of Basic Authentication: the mail app sends a username and password straight to Microsoft's server. Microsoft has been switching that off. Personal Outlook.com, Hotmail, Live, and MSN accounts lost it on September 16, 2024, app passwords included, for every outside mail app. Microsoft 365 work and school accounts lost it for reading mail over IMAP and POP starting October 1, 2022. Where it's off, an app password is rejected because Microsoft no longer accepts that sign-in method, not because the password is wrong.
Microsoft 365 sending is on its own timeline
For Microsoft 365 work accounts, sending mail with a password (SMTP AUTH) still works today where your organization allows it. Microsoft plans to switch it off by default for existing organizations at the end of December 2026; admins can turn it back on for a while, and Microsoft plans to announce a final removal date in the second half of 2027. Reading mail with a password (IMAP or POP) on Microsoft 365 is already off and can't be turned back on.
A new app password won't fix it
Generating a fresh app password doesn't help wherever Basic Authentication is off, because the method is what's being refused. What works is OAuth 2.0, which Microsoft calls Modern Authentication: you sign in on Microsoft's own page and the mail app gets a revocable access token instead of your password.
Your Gmail app passwords are a separate system
If you also connect a Gmail account somewhere, this change is Microsoft's alone. Gmail app passwords still work as long as 2-Step Verification is turned on for that Google account.
The fix: sign in with Microsoft
- Check which kind of account it is: a personal Outlook.com/Hotmail/Live/MSN address, or a Microsoft 365 work or school account.
- Stop regenerating app passwords for it - where Basic Authentication is off, every app password is refused the same way.
- Open Curo and choose to connect an Outlook.com or Microsoft 365 account.
- Click 'Sign in with Microsoft' - this takes you to Microsoft's own login page, not a form inside Curo - and complete any 2FA you already use.
- Approve the permission request. Your account is connected over OAuth, with no password stored anywhere, and Curo starts triaging it.