Basic Authentication Deprecation in Microsoft Graph API?

Question

question

maggie23-uipath asked May 6, '22 maggie23-uipath commented May 9, '22

Basic Authentication Deprecation in Microsoft Graph API?

As per Microsoft, Basic Authentication will be deprecated in Exchange Online effective October 1, 2022. This ability will be removed from Exchange ActiveSync (EAS), POP, IMAP, Remote PowerShell, Exchange Web Services (EWS), Offline Address Book (OAB), Outlook for Windows, and Mac.

I know it is not listed, but I want to double check if anybody knows for certain if the ability to authenticate with username/password to a Microsoft O365 application via the Microsoft Graph API will be removed. It is worth noting that this application will have access to Exchange mailboxes, which is where the confusion comes in if Microsoft's deprecation statement about Exchange Online will affect this flow or not.

There is a note that talks about disabling Basic Authentication in cloud environments that may include this ask, but it is not clear to me. The note in Microsoft's notice is as follows:

In Office 365 Operated by 21Vianet, we will begin disabling Basic authentiction on March 31, 2023. All other cloud environments are subject to the October 1, 2022 date.

azure-ad-app-registration azure-ad-graph azure-app-configuration microsoft-graph-authentication

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-05-06T23:07:58.69Z

grtaylor answered May 6, '22 maggie23-uipath commented May 9, '22

The ROPC grant is not affected by the deprecation of Basic Auth from Exchange Online. Only direct connections to Exchange with basic creds are affected. ROPC might not be recommended, but there are still more safeguards (app registration, consent, scope etc) with it, than there are with traditional username/password.

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

michev · May 07 at 04:48 AM

Thank you Greg!

1 ·

maggie23-uipath michev · May 09 at 01:55 PM

Thank you, @grtaylor!

0 ·

Answer 2 · 2022-05-06T17:05:50.097Z

michev answered May 6, '22 maggie23-uipath commented May 6, '22

Do you mean using the ROPC flow?

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

maggie23-uipath · May 06 at 06:12 PM

Hi @michev, I believe you might be right that the ROPC flow is what is being used. To clarify, the specific workflow I have in mind using this authentication method is using the Microsoft identity platform to establish an authenticated connection to a Microsoft O365 application registered in Azure AD. The connection enables a service authenticating with username/password to call the Microsoft Graph API to read and write resources on a user's behalf. This registered application in particular will have access to Exchange Online mailboxes. That is where my confusion comes in on whether or not this Basic Authentication flow will be decommissioned in October 2022 or not.

0 ·

michev maggie23-uipath · May 06 at 07:01 PM

I'm not 100% sure about the answer here. It's technically OAuth, so not considered basic auth, but it's also certainly not a recommended approach (you can see the big warning in the documentation). Whether Microsoft has any plans to block it specifically in the context of Exchange Online in the timeframes outlined above, I cannot tell. I've pinged an MS source on this and will circle back once I have an answer.

1 ·

maggie23-uipath michev · May 06 at 07:05 PM

Hi @michev, thank you very much. I'm looking forward to hearing back from you and your Microsoft resource.

0 ·

question