Deprecation of Outlook Web API: IMAP OAuth2 authentication and authorization with Graph API scopes

Esa Isoniemi 25 Reputation points
2024-03-08T08:15:52.6066667+00:00

We have a solution for authorizing and authenticating IMAP and SMTP via OAuth2 identity platform using authorization code flow. We’ve been aware of Outlook REST API deprecation, which caused no action since IMAP and SMTP Oauth2 authentication does not require use of Outlook or Graph REST API endpoints.

 A note at migration guide at https://learn.microsoft.com/en-us/outlook/rest/compare-graph does appear to state that IMAP and SMTP Oauth2 token audience is not affected, but while reviewing IMAP, SMTP and POP authentication guide new important notice caused confusion:

“This documentation uses the deprecated Outlook REST API scope. New applications should use the Graph REST API Endpoint instead.”

https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

 New and old app registrations with delegated graph API permissions still function when authorization and token retrieval is done with outlook resource URL in scopes (i.e. https://outlook.office.com/IMAP.AccessAsUser.All). However, while token retrieval with implicit or explicit resource URL in scopes succeed, all attempts to authenticate with mail server fail. ( i.e. https://graph.microsoft.com/IMAP.AccessAsUser.All )

Is it safe to conclude that Outlook scopes will continue functioning or is there a date for their removal?

Does March 31st Outlook Rest API end point closure and subsequent removal affect IMAP/SMTP authorization or authentication when using Outlook resource URL in permission scopes?

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
12,302 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.