This is entirely unsupported. We are providing this guide as a courtesy. If you do this, you’re doing it on your own.
If your mail client uses IMAP/POP and there’s no way around it, you can use DavMail as an intermediary which will accept your POP/IMAP connections, translate them to OWA calls, and let you continue to use your client, while still supporting MFA.
Aside from your usual mail client, you will need DavMail. Depending on your OS, you may need other tools. This guide is written for macOS Catalina, which also requires Java 8 SE. Other macOS variants will have slight differences, which are covered in the DavMail docs on the site.
- First, install Java 8. It’s pretty straightforward.
- Next, install DavMail. It’s a .app bundle you can move to your Applications folder.
- Try to run Davmail. It’s unsigned, so you need to jump through hoops to run it. Right click it and choose Open. It will probably fail or complain depending on your OS. After that, go to your Security and Privacy Preference Pane and you should see something like this. Click Open Anyway and you’re on the road.
- You’ll get a warning like this. Choose Open.
- You’ll get the settings pane for DavMail. I’ll describe how you can set it up, or you can skip to the end for a method to use the config file I used when setting this up.
- For Exchange Protocol, choose “o365Interactive”
- Take note of the ports on this screen. They’ll be handy when setting up your mail client.
- Click Encryption
- Under TenantId, use 0cfca185-25f7-49e3-8ae7-704d5326e285
- Under ClientId, use 8fd17012-cfee-4fc7-9fff-adebd6549a5e
- Under RedirectiUri, use https://login.microsoftonline.com/common/oauth2/nativeclient
- Click Save. You’re now running DavMail.
- Depending on your client, you’ll need to point it at your new setup. These directions presume you didn’t change the defaults above.
- Make sure your IMAP client is using host localhost, port 1143, and No SSL/TLS/Connection security. (This is okay, it’s a local connection on your machine and nothing is sent cleartext across the network.)
- Make sure username is <username>@anl.gov or whatever else you use to login to https://outlook.com/owa/anl.gov
- Authentication method is “Password”
- For outgoing SMTP mail, use localhost, port 1025, no encryption, password authentication
On checking your mail, you will get a popup window asking you to login to Office365. This is the same behavior you get if you visit https://outlook.com/owa/anl.gov or https://portal.office.com. If you’re configured for MFA, you will then get your preferred authentication method.
Congrats. You’re now using IMAP and POP with a Modern Auth middledman running on your laptop. DavMail needs to be running for this to work, so you may want to add it to your Login items in Users & Groups Preference Pane.
If you reboot, or quit/restart DavMail, you will need to reauthenticate.
I skipped to the end:
Here is a file named davmail.properties with the settings I described above. Quit DavMail. Save this file to your home directory as .davmail.properties (~/.davmail.properties). Restart DavMail. Now go back up a step to Configure client.