Definitive Guide to smtp auth vs basic auth vs oath auth vs oath2 vs. modern auth

Question

We need a hero.

With the improvement in the Security of M365, it is a challenge to properly set up various Multi-Function Printers. Anyone familiar with the Business Printer Provider Community knows their support struggles to provide comprehensive solutions for relatively common configurations. Terms like Basic versus Modern Authentication, OAuth versus Oath 2.0, etc. are not well understood by many of us and this leads to confusion on the practical steps to get the MFP's to support applications like Scan to E-mail.

I want to provide one example, complete with the solution I used. I could not get a Xerox AltaLink C8045 to work with a public outlook.com account. Wanted to try that to keep the cost down. I think Microsoft might be blocking that?

So, I created a M365 account. Using that account with the XEROX recommended settings only worked after I enabled SMTP AUTH in the Microsoft Admin Portal as explained in the following Microsoft link: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission#use-the-microsoft-365-admin-center-to-enable-or-disable-smtp-auth-on-specific-mailboxes.

This info should help others with a similar problem, which is great.

I think the M365 account being used for Scan to E-mail is now supporting SMTP AUTH and that is what the Xerox MFP requires. Furthermore, this is the only account supporting SMTP AUTH because Microsoft has set the default to not support SMTP AUTH. I think that is considered Basic Auth, not Modern Auth. I also think SMTP AUTH is a part of OAuth and Modern Auth is the same things as OAuth 2.0.

The Xerox Support folks don't know get the C8045 to use Modern Auth. If they did, that is the best way to set up Scan to E-mail. They believe the C8045 can utilize Modern Auth but not how to do it.

So, I will finish this post asking that someone who truly knows replies to say if my use of the terms is correct or not. If not, please correct them.
If some does that, it will go a long way to getting MFP’s using M365 accounts securely.
Also, as a bonus, it would help a lot of us out, if you could confirm:

1. Basic Auth is also called OAuth?
2. Modern Auth is also call OAuth 2.0?

Thanks, Peter

Answer 1

Hello @Pwzcebic ,

To answer the last two inquires,

1) Basic Auth is also called OAuth?

• Basic authentication simply means the application sends a username and password with every request, and those credentials are also often stored or saved on the device. Basic Auth usually happens when you provide a legacy app / printer with the combination of username/password without going through the usual web interface you see when you log into O365 services.
• Oauth 1 is an earlier version of OAuth 2.0 but it is not considered basic auth.

2) Modern Auth is also call OAuth 2.0?

• Correct. Modern authentication is based on the Active Directory Authentication Library (ADAL) and OAuth 2.0. You know you are using Oauth whenever you are faced with the usual web interface to log in to O365. A very nice place to test both Modern and Basic Authentication again a mailbox in your tenant is using this link: https://testconnectivity.microsoft.com/tests/O365Ola/input

To clarify things a bit more, in order to allow apps/printers/devices to access a certain mailbox and send email from that mailbox you can use either of the following:

• SMTP AUTH using an account/mailbox on Exchange Online
• Direct Send
• Configuring a Connector

All of these methods are explained here: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365

SMTP AUTH is usually recommended by most vendors/suppliers and is supported by most apps/devices. SMTP AUTH can be done using Basic and Modern Auth, depending on the vendor/app/device (but since MS is deprecating basic auth, it needs to be configured with Modern Auth). One thing to take into account here is that SMTP AUTH is controlled tenant-wide and on individual mailboxes. It is good practice to disable it tenant wide using Set-TransportConfig and then enable it on the mailboxes that need to be accessed using SMTP AUTH with the command Set-CASMailbox or via EAC. More details here: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission

I hope this is insightful,

Regards,
Said.

Answer 2

Hi @Pwzcebic ,
Agree with @Said Amchart and i will make some additions.
Microsoft is disabling Basic Authentication, and those that previously had SMTP authentication enabled will continue to be able to use it.

Refer to: Deprecation of Basic authentication in Exchange Online

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Thanks to @Said Amchart and @Jame Xu-MSFT for your responses. I look forward to your responses to my follow-up questions.

Answer 4

Hi @Pwzcebic ,
You could not consider SMTP AUTH as a method of basic authentication. You could consider one of the methods in SMTP AUTH to be basic authentication based on username and password. SMTP AUTH supports modern authentication (Modern Auth) through OAuth in addition to basic authentication. Disabling basic authentication only disables one of the SMTP AUTH authentication methods.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

And what happens with the security reasons of not having plain user and password in the connection? Any of these options could be done with a third party vendor for SMTP Relay? How to avoid SPAM, Phishing and others impersonating users with these devices that not support Multifactor Auth?