What the error is telling you
Basic Authentication is the older method where a mail client sends your username and password (or an app password) straight to the mail server. Microsoft switched it off for personal Outlook.com, Hotmail, Live, and MSN accounts on September 16, 2024, and for IMAP and POP on Microsoft 365 work and school accounts starting October 1, 2022. Your client is telling you, correctly, that this method no longer works for reading your mail.
It's specific to Microsoft, and it's final
There's no setting to flip it back on. For Microsoft 365, Microsoft's own documentation says Basic authentication is now disabled in all tenants and that no one - not your admin, not Microsoft support - can re-enable it. Only OAuth 2.0 sign-in is accepted for IMAP on these accounts. A client that only offers a password field can't read Outlook.com or Microsoft 365 mail over IMAP.
Sending is on a different schedule
Microsoft 365 sending (SMTP AUTH) is the one exception still in motion: it accepts passwords until Microsoft switches it off by default at the end of December 2026. That doesn't help with this error, which is about reading mail over IMAP.
Nothing changed for Gmail
If you're also connecting a Gmail account, this change doesn't touch it. Gmail app passwords still work with 2-Step Verification turned on.
The fix: sign in with Microsoft
- Confirm the account showing the error is Outlook.com, Hotmail, Live, MSN, or Microsoft 365 - this fix applies to those specifically.
- Open Curo and start connecting an Outlook.com or Microsoft 365 account.
- Choose 'Sign in with Microsoft' rather than entering a username and password.
- Complete Microsoft's own sign-in flow, including any two-factor step you normally use.
- Curo connects over OAuth, IMAP Basic Auth is never used, and your inbox starts triaging right away.