Forum Discussion I am facing an authentication failure issue while trying to connect for both IMAP and POP3 protocols using the Client Credential Grant flow for OAuth2.0 Where, I have been following the steps suggested in "https://docs.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#get-an-access-token" I have been using this github project to fetch the Access Token using Client Credential Grant flow: https://github.com/Azure-Samples/ms-identity-msal-java-samples/tree/main/1.%20Server-Side%20Scenarios/msal-client-credential-secret Java Code for IMAP : Java code for POP3 : Following are the credentials which I have used while performing the Client Credential Grant flow userEmail :- Email of the user which is used to login to Azure portal (eg, email address removed for privacy reasons) authority =https://login.microsoftonline.com/ <tenant - id - here> / client_id = <client(application) - id - here> secret = <client - secret - key - here> scope = https://outlook.office.com/.default Below Image contains list of permissions I have applied in my app: DEBUG: JavaMail version 1.5.6 DEBUG: successfully loaded resource: /META-INF/javamail.default.providers DEBUG: Tables of loaded providers DEBUG: Providers Listed By Class Name: {com.sun.mail.smtp.SMTPSSLTransport=javax.mail.Provider[TRANSPORT,smtps,com.sun.mail.smtp.SMTPSSLTransport,Oracle], com.sun.mail.smtp.SMTPTransport=javax.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle], com.sun.mail.imap.IMAPSSLStore=javax.mail.Provider[STORE,imaps,com.sun.mail.imap.IMAPSSLStore,Oracle], com.sun.mail.pop3.POP3SSLStore=javax.mail.Provider[STORE,pop3s,com.sun.mail.pop3.POP3SSLStore,Oracle], com.sun.mail.imap.IMAPStore=javax.mail.Provider[STORE,imap,com.sun.mail.imap.IMAPStore,Oracle], com.sun.mail.pop3.POP3Store=javax.mail.Provider[STORE,pop3,com.sun.mail.pop3.POP3Store,Oracle]} DEBUG: Providers Listed By Protocol: {imaps=javax.mail.Provider[STORE,imaps,com.sun.mail.imap.IMAPSSLStore,Oracle], imap=javax.mail.Provider[STORE,imap,com.sun.mail.imap.IMAPStore,Oracle], smtps=javax.mail.Provider[TRANSPORT,smtps,com.sun.mail.smtp.SMTPSSLTransport,Oracle], pop3=javax.mail.Provider[STORE,pop3,com.sun.mail.pop3.POP3Store,Oracle], pop3s=javax.mail.Provider[STORE,pop3s,com.sun.mail.pop3.POP3SSLStore,Oracle], smtp=javax.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle]} DEBUG: successfully loaded resource: /META-INF/javamail.default.address.map DEBUG: setDebug: JavaMail version 1.5.6 DEBUG: getProvider() returning javax.mail.Provider[STORE,imap,com.sun.mail.imap.IMAPStore,Oracle] DEBUG IMAP: mail.imap.fetchsize: 16384 DEBUG IMAP: mail.imap.ignorebodystructuresize: false DEBUG IMAP: mail.imap.statuscachetimeout: 1000 DEBUG IMAP: mail.imap.appendbuffersize: -1 DEBUG IMAP: mail.imap.minidletime: 10 DEBUG IMAP: enable STARTTLS DEBUG IMAP: enable SASL DEBUG IMAP: SASL mechanisms allowed: XOAUTH2 DEBUG IMAP: closeFoldersOnStoreFailure DEBUG IMAP: trying to connect to host "outlook.office365.com", port 993, isSSL true * OK The Microsoft Exchange IMAP4 service is ready. [UABOADMAU...<token_value>] A0 CAPABILITY * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+ A0 OK CAPABILITY completed. DEBUG IMAP: AUTH: PLAIN DEBUG IMAP: AUTH: XOAUTH2 DEBUG IMAP: protocolConnect login, host=outlook.office365.com, user=email address removed for privacy reasons, password=<non-null> DEBUG IMAP: SASL Mechanisms: DEBUG IMAP: XOAUTH2 DEBUG IMAP: DEBUG IMAP: SASL client XOAUTH2 DEBUG IMAP: SASL callback length: 2 DEBUG IMAP: SASL callback 0: javax.security.auth.callback.NameCallback@73f9ac DEBUG IMAP: SASL callback 1: javax.security.auth.callback.PasswordCallback@1064425 A1 AUTHENTICATE XOAUTH2 dXNlc...<token-value-here> A1 NO AUTHENTICATE failed. javax.mail.AuthenticationFailedException: AUTHENTICATE failed. at com.sun.mail.imap.IMAPStore.protocolConnect(IMAPStore.java:725) at javax.mail.Service.connect(Service.java:366) at javax.mail.Service.connect(Service.java:246) at test.ClientCredentialGrantAndConnect.connectIMAP(ClientCredentialGrantAndConnect.java:166) at test.ClientCredentialGrantAndConnect.main(ClientCredentialGrantAndConnect.java:45) DEBUG: JavaMail version 1.5.6 DEBUG: successfully loaded resource: /META-INF/javamail.default.providers DEBUG: Tables of loaded providers DEBUG: Providers Listed By Class Name: {com.sun.mail.smtp.SMTPSSLTransport=javax.mail.Provider[TRANSPORT,smtps,com.sun.mail.smtp.SMTPSSLTransport,Oracle], com.sun.mail.smtp.SMTPTransport=javax.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle], com.sun.mail.imap.IMAPSSLStore=javax.mail.Provider[STORE,imaps,com.sun.mail.imap.IMAPSSLStore,Oracle], com.sun.mail.pop3.POP3SSLStore=javax.mail.Provider[STORE,pop3s,com.sun.mail.pop3.POP3SSLStore,Oracle], com.sun.mail.imap.IMAPStore=javax.mail.Provider[STORE,imap,com.sun.mail.imap.IMAPStore,Oracle], com.sun.mail.pop3.POP3Store=javax.mail.Provider[STORE,pop3,com.sun.mail.pop3.POP3Store,Oracle]} DEBUG: Providers Listed By Protocol: {imaps=javax.mail.Provider[STORE,imaps,com.sun.mail.imap.IMAPSSLStore,Oracle], imap=javax.mail.Provider[STORE,imap,com.sun.mail.imap.IMAPStore,Oracle], smtps=javax.mail.Provider[TRANSPORT,smtps,com.sun.mail.smtp.SMTPSSLTransport,Oracle], pop3=javax.mail.Provider[STORE,pop3,com.sun.mail.pop3.POP3Store,Oracle], pop3s=javax.mail.Provider[STORE,pop3s,com.sun.mail.pop3.POP3SSLStore,Oracle], smtp=javax.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle]} DEBUG: successfully loaded resource: /META-INF/javamail.default.address.map DEBUG: setDebug: JavaMail version 1.5.6 DEBUG: getProvider() returning javax.mail.Provider[STORE,pop3,com.sun.mail.pop3.POP3Store,Oracle] DEBUG POP3: mail.pop3.rsetbeforequit: false DEBUG POP3: mail.pop3.disabletop: false DEBUG POP3: mail.pop3.forgettopheaders: true DEBUG POP3: mail.pop3.cachewriteto: false DEBUG POP3: mail.pop3.filecache.enable: false DEBUG POP3: mail.pop3.keepmessagecontent: false DEBUG POP3: mail.pop3.starttls.enable: true DEBUG POP3: mail.pop3.starttls.required: true DEBUG POP3: mail.pop3.finalizecleanclose: false DEBUG POP3: mail.pop3.apop.enable: false DEBUG POP3: mail.pop3.disablecapa: false DEBUG POP3: connecting to host "outlook.office365.com", port 995, isSSL false javax.mail.AuthenticationFailedException: Read timed out at com.sun.mail.pop3.POP3Store.protocolConnect(POP3Store.java:213) at javax.mail.Service.connect(Service.java:366) at javax.mail.Service.connect(Service.java:246) at test.ClientCredentialGrantAndConnect.connectPOP(ClientCredentialGrantAndConnect.java:209) at test.ClientCredentialGrantAndConnect.main(ClientCredentialGrantAndConnect.java:50) Following is the list of jars I have used as a part of this development: My Java Code Link(ideone): https://ideone.com/2RaWN9

Please help and let me know if the program is not correct. Or if any important step seems to be missing. borist2 Jul 29, 2022 Hi. I had the same problem, but I think I made some progress. I read documentation few times, tried few times from the start with same error. I even have tried using client and object ids instead of email as username, in lack of better ideas. So this is where I think I have made mistake previous times. When you are at the part that you need to register service principal, you need to execute New-ServicePrincipal -AppId <APPLICATION_ID> -ServiceId <OBJECT_ID> [-Organization <ORGANIZATION_ID>] here I put enterprise application object id as ServiceId argument. And that is ok. But on Add-MailboxPermission -Identity "email address removed for privacy reasons" -User <SERVICE_PRINCIPAL_ID> -AccessRights FullAccess I have put my registered application object id as User argument. I also tried setting object id of enterprise application, but it did not have success. I also tried New-ServicePrincipal but with registered app object id as service id, but it gave me the same result. When I executed Get-ServicePrincipal -Organization <ORGANIZATION_ID> | fl I did not pay attention to ServiceId property, even with documentation specifying it and saying it will be different. Now I cleared everything and started fresh. I executed all the steps again, but on the step when I need to add mail permission, I list service principals, and then use `ServiceId` value from the output, as argument for user. With that, I was able to authorise. Unfortunately, now I receive `C3 BAD User is authenticated but not connected.` when I try to list inbox. But it is step forward. I am not sure if you made the same error as me, but maybe it will help you in some way. I will post info, when I find fix for the new error if somebody comes across same issue. Marked as Solution Hi. I had the same problem, but I think I made some progress. I read documentation few times, tried few times from the start with same error. I even have tried using client and object ids instead of email as username, in lack of better ideas. So this is where I think I have made mistake previous times. When you are at the part that you need to register service principal, you need to execute here I put enterprise application object id as ServiceId argument. And that is ok. I have put my registered application object id as User argument. I also tried setting object id of enterprise application, but it did not have success. I also tried New-ServicePrincipal but with registered app object id as service id, but it gave me the same result. When I executed I did not pay attention to ServiceId property, even with documentation specifying it and saying it will be different. Now I cleared everything and started fresh. I executed all the steps again, but on the step when I need to add mail permission, I list service principals, and then use `ServiceId` value from the output, as argument for user. With that, I was able to authorise. Unfortunately, now I receive `C3 BAD User is authenticated but not connected.` when I try to list inbox. But it is step forward. I am not sure if you made the same error as me, but maybe it will help you in some way. I will post info, when I find fix for the new error if somebody comes across same issue.