What is this about?
Two major mail server providers, Microsoft and Google, have announced deprecations to the authentication methods supported for retrieving email from their cloud based systems. These changes may prevent receiving email from their servers when these providers implement those changes. While there is no immediate impact or actions required, we wanted to make you aware of these planned changes.
Who does this impact?
Users of Moxie’s Email who use Microsoft or Google cloud based email servers for retrieving email. Microsoft’s Microsoft 365 and Google’s G Suite / Gmail have made public announcements about this change.
What’s changed?
Moxie supports Post Office Protocol (POP) and Internet Message Access Protocol (IMAP) protocols to retrieve email from email servers as well as Simple Mail Transfer Protocol (SMTP) protocol.to send email. These protocols currently support both user name / password as well as OAuth 2.0 authentication methods. Microsoft 365 and Gmail have announce plans for deprecating the older user name / password method of authentication.
When did these changes taking effect?
Microsoft’s Microsoft 365
Microsoft announced that on October 13th, 2020 they will stop supporting and retire Basic Authentication (user name and password authentication) for POP and IMAP. Applications using Basic Authentication will not be able to connect to Microsoft 365 mailboxes and will need to update the authentication method to OAuth.
Basic Authentication in addition to OAuth SMTP will be supported by Microsoft. Microsoft has indicated that there may be an exception process to enable continued use of Basic Authentication, however, this may change.
Microsoft published an update Sept 1, 2021:
Today, we are announcing that, effective October 1, 2022, we will begin to permanently disable Basic Auth in all tenants, regardless of usage, with the exception of SMTP Auth.
We’re removing the ability to use Basic authentication in Exchange Online for Exchange ActiveSync (EAS), POP, IMAP, Remote PowerShell, Exchange Web Services (EWS), Offline Address Book (OAB), Outlook for Windows, and Mac.
We’re also disabling SMTP AUTH in all tenants in which it’s not being used.
This decision requires customers to move from apps that use basic authentication to apps that use Modern authentication. Modern authentication (OAuth 2.0 token-based authorization) has many benefits and improvements that help mitigate the issues in basic authentication. For example, OAuth access tokens have a limited usable lifetime, and are specific to the applications and resources for which they are issued, so they cannot be reused. Enabling and enforcing multifactor authentication (MFA) is also simple with Modern authentication.
Google
Google is suspending their previous announcements and the LSA turn-off is suspended until further notice. All previously announced timeframes no longer apply. Google had stated starting in June 2020, Google will limit the ability for Less Secure Applications (LSAs) to access G Suite. LSAs are applications that use username / password authentication. LSAs must be updated to support OAuth in order to continue accessing G Suite. Access to LSAs will be turned off in two stages:
- After June 15, 2020 - Users who try to connect to an LSA for the first time will no longer be able to do so. This includes third-party apps that allow password-only access to G Suite email. Users who have connected to LSAs prior to this date will be able to continue using them until usage of all LSAs is turned off.
- After February 15, 2021 - Access to LSAs will be turned off for all G Suite accounts.
Moxie has you covered
As mentioned above, Microsoft published access and the methods to utilize OAuth authentication for POP, IMAP and SMTP.
Moxie has released support for Microsoft 365 as well as Google’s G Suite's using OAuth 2.0 authentication. We suggest you assure you are on Channels 9.4 CU15 QFE 6 or later and plan to update your mailboxes accordingly.
Moxie will work with you to plan an upgrade as needed.. Once upgraded, changes to your mailbox settings via Moxie’s Channels Administrator as well as your cloud based email provider will be required to update your authentication methods.
If you have any questions please do not hesitate to contact Moxie Support or your Moxie Customer Success Manager.