Deprecation of Outlook Web API: IMAP OAuth2 authentication and authorization with Graph API scopes
We have a solution for authorizing and authenticating IMAP and SMTP via OAuth2 identity platform using authorization code flow. We’ve been aware of Outlook REST API deprecation, which caused no action since IMAP and SMTP Oauth2 authentication does not require use of Outlook or Graph REST API endpoints.
A note at migration guide at https://learn.microsoft.com/en-us/outlook/rest/compare-graph does appear to state that IMAP and SMTP Oauth2 token audience is not affected, but while reviewing IMAP, SMTP and POP authentication guide new important notice caused confusion:
“This documentation uses the deprecated Outlook REST API scope. New applications should use the Graph REST API Endpoint instead.”
New and old app registrations with delegated graph API permissions still function when authorization and token retrieval is done with outlook resource URL in scopes (i.e. https://outlook.office.com/IMAP.AccessAsUser.All). However, while token retrieval with implicit or explicit resource URL in scopes succeed, all attempts to authenticate with mail server fail. ( i.e. https://graph.microsoft.com/IMAP.AccessAsUser.All )
Is it safe to conclude that Outlook scopes will continue functioning or is there a date for their removal?
Does March 31st Outlook Rest API end point closure and subsequent removal affect IMAP/SMTP authorization or authentication when using Outlook resource URL in permission scopes?