What Major Email Services Now Require OAuth2?

Authentication has become more secure

Royalty Free Pixabay Image

Keywords:
password, outlook, microsoft, authentication, comcast

Key Takeaway:
OAuth2 is a modern and more secure way to log in to your email account.

Category Insights:
SECURITY — Security best practices include strong passwords, MFA, and regular patching.

What Is OAuth2?

OAuth2 is a modern and more secure way to log in to your email account. Instead of typing in your password each time, OAuth2 lets you sign in through a trusted system that gives apps permission to access your email without exposing your actual password. Put simply, OAuth2 is just a new version of the authentication (log-in) process.

Why the Change?

Email security has become more important than ever. Hackers are constantly trying to steal passwords, and the old way of logging in using just your username and password is no longer considered safe. That’s why many major email providers are now requiring OAuth2—it helps protect your account from unauthorized access.

• It avoids sharing or storing actual passwords.
• Users authenticate directly with the provider and grant token-based access.
• Tokens can be limited in scope and revoked independently.

Which Email Services Require OAuth2?

Several major email services have already made OAuth2 mandatory or are in the process of doing so. Here are some of the big names:

• Google (Gmail) Gmail has used OAuth2 for many years and requires it for all third-party apps. Basic authentication (using just a password) has been disabled for most accounts. App Passwords are only available for accounts with 2FA enabled and are being phased out.
  
  
• Microsoft (Outlook, Hotmail, Live) Microsoft also requires OAuth2 for secure connections to Outlook and other Microsoft accounts. Microsoft Outlook (2019 and older) will NOT support OAuth2. Basic authentication was deprecated and disabled in October 2022 for most Microsoft services. Outlook.com also enforces OAuth2 for modern apps.
  
  
• Yahoo Mail Yahoo has moved to OAuth2 for added protection. Legacy apps may still use app passwords, but OAuth2 is the default and secure method. Basic authentication is largely deprecated.
  
  
• AOL Mail Same backend as Yahoo (both owned by Yahoo/Verizon). OAuth2 required or app password needed. No longer allows standard password login from third-party apps.
  
  
• Apple (iCloud Mail) Apple uses OAuth2 through the Sign In with Apple system.
  
  
• Comcast (Xfinity Email) Comcast requires OAuth2 for all third-party email applications. If you use programs like Outlook, Thunderbird, or a phone app to check your Comcast email, you must update your settings to use OAuth2.
  
  Note: If you combine Comcast (Xfinity Email) with Mozilla Thunderbird, you may encounter issues with OAuth2 support. It seems to be a known issue and will occasionally cause problems. This is documented on many websites. It is unknown if this will be resolved in the future by either party. I would encourage Thunderbird users to switch to another email client.
  
  
• iCloud Mail (Apple) Uses a custom authentication flow with OAuth-like tokens. Requires App-Specific Passwords for third-party apps, not traditional OAuth2, but still avoids raw password use.
  
  
• GMX / Mail.com Supports OAuth2, though not required yet. May still support basic auth but it's likely to change as standards evolve.
  
  
• Fastmail Supports OAuth2. You can still use app passwords (recommended), but OAuth2 is encouraged for new integrations.

What You Should Do

If you’re using an older email app that still asks for a regular password, it might stop working. To fix this:

1. Check your email provider’s website for instructions on setting up OAuth2.
2. Update your email app to the latest version.
3. If needed, use an “app password” or go through the OAuth2 sign-in process.

Conclusion

Reference: