How to setup MultiPOP for use with Microsoft 365 using OAuth

In late 2022, Microsoft retired Basic Authentication, which will cause MultiPOP configurations for users to no longer collect mail. MDaemon deployed support for OAuth 2.0 in MDaemon 23.0.0 to continue to use MultiPOP for Microsoft 365 accounts.

HTTPS for MDaemon Webmail must be enabled with a valid certificate. Self-signed certificates are not recommended.

Follow the steps below to configure Azure and MDaemon to allow MDaemon to authenticate using OAuth and continue to download mail via MultiPOP.

In Azure Active Directory:

Navigate to the App Registrations page
Select New Registration
Enter an application name in the name field.
For Supported account types select Accounts in any organizational directory (Any Azure AD directory - Multitenant)
For "Redirect URI" select web and then enter your redirect URI.
Change mail.company.test to the FQDN of the MDaemon server
https://mail.company.test/WorldClient.dll?View=OAuth&AuthRequest=Office365
Select Register
Make note of the Application (client) ID
Select API Permissions
Select + Add a permission
Select Microsoft Graph
Select Delegated Permissions
Select POP.AccessAsUser.All and User.Read (User.Read is already selected by default)
Select Add permissions
Select Certificates & Secrets
Click + New Client Secret
Enter a description in the description field.
Select how long the password will be valid for.
Click Add
Copy the password generated in the Value field as it will not be viewable again.

In MDaemon:

Open the MDaemon GUI
Select Setup
Select Server Settings
Select MultiPOP
Select Enable MultiPOP
In the Office365 section, enter the Application (Client) ID from Step 7 above in the Client ID text box.
Enter the Value from Step 19 above in the Client Secret text box.
Click OK

To create a new MultiPOP profile for a user:

Open MDaemon
Select Accounts
Select Edit Account
Double click on the account to open the account in the Account Editor.
Select MultiPOP
Select Enable MultiPOP
Enter outlook.office365.com:995 for the Server text box.
Enter the Microsoft 365 address in the Logon text box.
Enter the Microsoft 365 address password in the Password text box.
Verify Enable this entry is checked.
Check the Leave a copy of message on POP server if desired.
Select Use OAuth
Choose the number of days to delete messages older than. (0 = never delete)
Choose the maximum size of messages that MDaemon should download. (0 = no limit)

To edit an existing MultiPOP profile in MDaemon's GUI:

Alternatively, the MultiPOP profile can be created or edited in MDaemon's Remote Administration:

Login to Remote Administration as a global or domain admin.
Select Account Manager
Double click the account to edit.
Select MultiPOP from the Account Settings
Double Click on the host or select the host and click Edit to edit an existing profile or click New to create a new MutliPOP profile.
Check the Use OAuth checkbox
Click Save and Close

End Users must have the ...edit MultiPOP settings web service enabled in order to authorize the account with Microsoft 365.

To do this:

Once enabled, the end user will need to perform the steps below to authorize MDaemon to connect to the Microsoft 365 account.