Basic authentication is a traditional method for login with only a pair of username and password. Attackers may easily perform brute force or password spray attacks to system. To cope with cyber-attack, Microsoft decided to disable Basic Authentication in Office 365 Email (Exchange Online) with effective from 1 October 2022.
After Basic Authentication is disabled, a list of protocols* will be affected and no longer be able to send / receive email or sync calendar. Users who are using outdated versions of Outlook client, third party email apps, and O365 sync in mobile device will be affected and have to update their apps / settings from Basic Authentication to Modern Authentication for login.
Notification with procedures to update the authentication method will be sent to users currently using Basic Authentication on their devices. Please take actions accordingly if you are using the following platforms for Office 365 Email:
- Office PC: Update to Outlook 2016 or the latest, enable Modern Authentication, and re-create email profile.
- Mobile device: Install Outlook mobile app for email. Remove and re-add the account from the iOS/Android system setting for calendar sync.
- Third party email clients: Update to version with Modern Authentication support / Microsoft Graph.
- PolyU SMTP (smtp.polyu.edu.hk): Will not be affected.
Should you need further information, please feel free to contact our IT HelpCentre (Tel: 2766 5900, WhatsApp/WeChat: 6577 9669).
*Affected protocols including POP3, IMAP4, Active Sync, MAPI / RPC over HTTP connection, Exchange Web Services in older Outlook clients, other third-party clients / apps / integration, and native mail apps for mobile
