Outlook 2016 doesn't accept password or app password

In addition to this post from AnotherBug I have found this statement of Diane Poremsky, an independent contultant here in the community forums (Diane Poremsky [M365 Apps & Services MVP]):

"[...]Do you have 2-step verification enabled on your account? If so, try using an app password as EAS doesn't support modern authentication.[...]"

So there is no modern authentication support for EAS at all. It would be nice to get an official statement from Microsoft here.

In addition to this its stated that we, as paid customers of M365 (personal/consumer), have the possibility to open chat tickets within the paid apps. This is right, but the first level support is a real mess. For example:

I contacted them because I added an internet calendar to my outlook.com account (subscription). The Microsoft documentation tells me that this subscription of the calendar will automatically update when there are new events or changes to existing ones within the subscribed calendar. But in fact this subscription does not work. It will only import the current data and will not update. I added it via Outlook.com Web since I want my account to manage the updates (so the exchange server).

The Microsoft support agent first asked me, what browser I use to log into my Mails. Then he told me to just delete all my mobile devices listed in the outlook.com accounts web interface because this could cause synchronization problems...

But its not that the calendar events will not synchronize with the mobile devices (of course they do not from time to time, this is the problem pointed out in this thread) but its the subcription that will not work. So the internet calendar events are not updated from the server of the third party providing the ics subscription.

As this should be handled by the microsoft server (microsoft should ask from time to time if there are new events as they for sure want no push of new events because of the server load) but in fact its not. The subscription of internet calendars just work as import and not as synch...

So, asking here in the community forums will get us no answers and even the support we have because we pay will get us no support.

Hi guys, I think I found a solution (at least for mobile users).

We assume that the EAS protocol for consumer users (via eas.outlook.com server) no longer works (or very often gives synchronization errors, until it is disabled completely) because it does not support modern OAuth authentication.

It is very unfortunate that Microsoft has not made this official so far; the information reported in this article, in fact, is NO longer applicable for consumer accounts: Set up email in Android email app - Microsoft Support

As regards any 365 company accounts, however, everything still works correctly through the addition from "Exchange and Office 365" and they are automatically configured without problems with OAuth via the dedicated server outlook.office365.com

Below is a summary of the steps that led me to solve my problems:

1. delete the existing EAS account and re-add it as a normal IMAP account (on Android you just need to select "outlook, hotmail and live") to at least allow email synchronization with third-party apps (gmail or other);
2. download app outlook mobile (even if you have no intention of using it actively), add the accounts of interest and give it all background permissions, excluding it from any battery optimizations. Go to the app settings and for each account in which you are interested in also synchronizing contacts and/or calendar, select the relevant options "synchronize contacts" and/or "synchronize calendars". In this way, the "Outlook" category will be added within the Android system accounts, which will allow system-wide synchronization and should be viewable/usable by any third-party app (in theory).

I have verified that the two-way synchronization of contacts (with the native Android "contacts" app) is immediate and efficient. However, I noticed some small problems with the synchronization of calendar events on Google Calendar, especially for changes to a pre-existing event, however, it is quite reliable. Personally, while I was doing these tests, I also discovered that the outlook mobile app allows you to insert a very useful "shortcut" icon directly for the calendar section (it is found inside the dedicated widgets) and therefore I am trying to use the calendar directly from here (instead of Google Calendar or other), to have maximum synchronization reliability.

I am confident that this procedure can solve contact and calendar synchronization problems for anyone, at least on Android mobile devices.

I leave the judgments on all this to you (obligation, even for 365 subscriber users, to download the outlook mobile app to enjoy complete synchronization).

P.S. From what I understand (but I could be wrong), OAuth also now makes the "app password" useless and outdated, since I believe it only makes sense in combination with basic authentication.

P.S. From what I understand (but I could be wrong), OAuth also now makes the "app password" useless and outdated, since I believe it only makes sense in combination with basic authentication.

That's the intention. But for apps which don't support OAuth2, app passwords are a compromise.

Yet another authentication error on EAS 9Folders, outlook.com account.

Hi guys, I think I found a solution (at least for mobile users).

1. download app outlook mobile (even if you have no intention of using it actively), add the accounts of interest and give it all background permissions, excluding it from any battery optimizations. Go to the app settings and for each account in which you are interested in also synchronizing contacts and/or calendar, select the relevant options "synchronize contacts" and/or "synchronize calendars". In this way, the "Outlook" category will be added within the Android system accounts, which will allow system-wide synchronization and should be viewable/usable by any third-party app (in theory).

I've already tried this method weeks ago. It has multitude of issues. You are essentially using Outlook for Android to handle the contact/calendar sync only. Outlook for Android would store data within the scope of the app itself, i.e., app-local databases. You then enable its sync to the device-global contact and calendar database, so then you can access those data via the stock calendar and contact apps and even email client when looking up contacts. The issue is, the moment you enable this, Outlook for Android would then have access to your device-global contact and calendar databases, which is a 2-way access, including reading data from other accounts you may have added, but wanted to shield Microsoft from accessing. This method is just another way to do proxying. This is the exact method how apps like Facebook scrape your contacts and so on...

I was talking to some security/privacy experts and they see a strong indication Microsoft is messing with the EWS/EAS on purpose. By forcing us to use Outlook mobile client, they then could scrape data on our devices from other platforms. This is certainly how I would design it if I want to backdoor access user's 3rd party platform data.