I can't use POP3 to read OUTLOOK mail

Question

Below is the code that I used:

try
{
    using (var client = new Pop3Client())
    {
        client.Connect("outlook.office365.com", 995, true);

        client.Authenticate("email", "pass");

        int messageCount = client.Count;

        for (int i = 0; i < messageCount; i++)
        {
            MimeMessage message = client.GetMessage(i);
            File.AppendAllText("Data.txt", $"{message.Subject}\n");
        }
        client.Disconnect(true);
    }
}
catch (Exception ex)
{
    MessageBox.Show(ex.Message);
}

I have used this code to read mail before and it worked perfectly fine. but now I am getting authentication failed message. Even though I still use that email and password, I tried logging in to the account in the browser and it logged in completely fine.

Answer 1

As of September 16th, Microsoft has started requiring OAuth2 authentication for their email servers.

In order to authenticate via POP3 (and IMAP and SMTP), you will now be required to use OAuth2 authentication.

Step 1: Registering Your Application with Microsoft

The first thing you'll need to do is register your application with Microsoft's Identity Platform. To do this, go to Microsoft's Quickstart guide and follow the instructions.

Step 2: Configuring the Correct API Permissions for Your Application

There are several different API permissions that you may want to configure depending on which protocols your application intends to use.

Follow the instructions for adding the POP, IMAP, and/or SMTP permissions to your Entra AD application.

Step 3: Obtaining the OAuth2 Access Token

Now that you have the Client ID and Tenant ID strings, you'll need to plug those values into your application.

The following sample code uses the Microsoft.Identity.Client nuget package for obtaining the access token which will be needed by MailKit to pass on to the Exchange server.

static async Task<AuthenticationResult> GetPublicClientOAuth2CredentialsAsync (string protocol, string emailAddress, CancellationToken cancellationToken = default)
{
    var options = new PublicClientApplicationOptions {
        ClientId = "Application (client) ID",
        TenantId = "Directory (tenant) ID",

        // Use "https://login.microsoftonline.com/common/oauth2/nativeclient" for apps using
        // embedded browsers or "http://localhost" for apps that use system browsers.
        RedirectUri = "https://login.microsoftonline.com/common/oauth2/nativeclient"
    };
 
    var publicClientApplication = PublicClientApplicationBuilder
        .CreateWithApplicationOptions (options)
        .Build ();

    string[] scopes;
 
    if (protocol.Equals ("IMAP", StringComparison.OrdinalIgnoreCase)) {
        scopes = new string[] {
            "email",
            "offline_access",
            "https://outlook.office.com/IMAP.AccessAsUser.All"
        };
    } else if (protocol.Equals ("POP", StringComparison.OrdinalIgnoreCase)) {
        scopes = new string[] {
            "email",
            "offline_access",
            "https://outlook.office.com/POP.AccessAsUser.All"
        };
    } else {
        scopes = new string[] {
            "email",
            "offline_access",
            "https://outlook.office.com/SMTP.Send"
        };
    }

    try {
        // First, check the cache for an auth token.
        return await publicClientApplication.AcquireTokenSilent (scopes, emailAddress).ExecuteAsync (cancellationToken);
    } catch (MsalUiRequiredException) {
        // If that fails, then try getting an auth token interactively.
        return await publicClientApplication.AcquireTokenInteractive (scopes).WithLoginHint (emailAddress).ExecuteAsync (cancellationToken);
    }
}

Step 4: Authenticating with the OAuth2 Access Token

var result = await GetPublicClientOAuth2CredentialsAsync ("POP", "username@outlook.com");

// Note: We always use result.Account.Username instead of `Username` because the
// user may have selected an alternative account.
var oauth2 = new SaslMechanismOAuth2 (result.Account.Username, result.AccessToken);

using (var client = new Pop3Client ()) {
    await client.ConnectAsync ("outlook.office365.com", 995, SecureSocketOptions.SslOnConnect);
    await client.AuthenticateAsync (oauth2);

    int messageCount = client.Count;

    for (int i = 0; i < messageCount; i++)
    {
        MimeMessage message = await client.GetMessageAsync(i);
        File.AppendAllText("Data.txt", $"{message.Subject}\n");
    }

    await client.DisconnectAsync (true);
}

Note: this example uses MailKit's async APIs, but you could continue to use the synchronous APIs if you want.

Answer 2

Microsoft deprecated basic authentication for Exchange Online

You can read more about the timelines, your options, etc in the following two links. But the gist of it is

Basic authentication is now disabled in all tenants.
[...] no one (you or Microsoft support) can re-enable Basic authentication in your tenant

September 16th, 2024
Basic Authentication no longer available to access any Outlook account

• Modern Authentication Methods now needed to continue syncing Outlook Email in non-Microsoft email apps
• Deprecation of Basic authentication in Exchange Online