Issue with SharePoint Access Due to Discontinuation of Basic Authentication

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.  

Hi @Selvakumar K

Thank you for reaching out regarding the “Forbidden” error you are encountering when attempting to access SharePoint Online documents using app passwords. 

I understand that this issue is caused by Microsoft’s platform-wide retirement of Basic Authentication across all Microsoft 365 services, including SharePoint Online, and that this change is impacting your workflow. Since app passwords rely entirely on this legacy authentication method, they are now fully blocked at the service level by Microsoft. 

Regarding to your concerns: 

For temporary extension or re-enablement of Basic Authentication method  

Unfortunately, I have not identified any supported method to temporarily extend, bypass, or re-enable Basic Authentication or app passwords for any Microsoft 365 workload. 

Since Basic Authentication is now permanently disabled in all tenants for Exchange Online, SharePoint Online, and other Microsoft 365 services. Neither customers nor Microsoft Support can turn it back on. 

Recommended migration approach 

To restore application access to SharePoint Online and ensure long-term compatibility, the recommended approach is to migrate to Modern Authentication (OAuth 2.0) using Microsoft Entra ID (formerly Azure AD). 

You could refer to the concrete steps to take depending on the application type: 

1.Set up App Registration in Microsoft Entra ID:

Go to the Microsoft Entra Admin Center. 

Navigate to Identity > Applications > App registrations and register a new application. 

2.Choose the corresponding flow based on your app type: 

For Background/Server Applications (Daemon apps): Use the Client Credentials flow (App-only access). You must configure a Certificate or Client Secret for the application and grant it the appropriate API permissions (such as Sites.Read.All or Sites.ReadWrite.All on the Microsoft Graph API).  

For User-facing or Rich Client Applications: The application must be updated to use Interactive user sign-in flows that fully support Multi-Factor Authentication (MFA).  

For handling custom applications during transition 

While updating your custom applications, you could consider to follow these recommendations: 

Remove Dependencies: Plan to permanently remove all code dependencies on Basic Authentication (username/password strings) and app passwords.  

Adopt Microsoft Graph API: Instead of using older SharePoint REST APIs, we highly recommend migrating your integration layer to Microsoft Graph API. It is the most robust, modern, and supported method for file operations in Microsoft 365.  

Third-Party Applications: If you are using third-party software, please contact the vendor immediately. You must request a patch or an updated version that integrates OAuth 2.0 support.  

References: 

Basic authentication sign-in prompts are blocked by default in Microsoft 365 Apps 

Authentication and authorization in Microsoft Graph 

I hope this helps. 

Please feel free to correct me if I misunderstood your request. If you have any additional concerns, feel free to comment below. I would be more than happy to assist. 

Note: Please follow the steps in [our documentation] to enable e-mail notifications if you want to receive the related email notification for this thread. 

Basic authentication and app passwords can no longer be used with Microsoft 365 services, including SharePoint Online, and they cannot be re-enabled or extended.

1. Temporary use of Basic authentication / app passwords

• Basic authentication is now disabled in all tenants for Exchange Online and other Microsoft 365 services, and neither customers nor Microsoft Support can turn it back on.
• App passwords rely on legacy/basic auth flows and are explicitly blocked when modern authentication is required.
• Because of this platform change, there is no supported way to temporarily extend or re‑enable Basic authentication or app passwords for SharePoint Online or other Microsoft 365 workloads.

2. Recommended migration approach to Modern Authentication For custom or legacy applications (such as Rototherm and ERS Prospector) that integrate with Microsoft 365 services:

• Replace Basic authentication with OAuth 2.0–based modern authentication.
• For services like Exchange, POP/IMAP, EWS, and EAS, the guidance is:
  • If custom code was written using these protocols, update it to use OAuth 2.0 or migrate to Microsoft Graph.
  • If a 3rd‑party application is used, work with the vendor to add OAuth 2.0 support or move to an application that already supports it.
• For SharePoint Online specifically, use modern authentication via Microsoft Entra ID (Azure AD) and OAuth 2.0 in one of these ways (depending on app type):
  • Interactive user sign‑in with modern auth (MFA-capable) for rich clients.
  • App-only access using an Entra application registration and certificate/secret, then calling SharePoint/Graph APIs.

3. Handling custom applications during the transition While updating the applications:

• Plan to remove all dependencies on Basic authentication and app passwords; they are deprecated and blocked across Microsoft 365.
• Implement OAuth 2.0 flows in the applications:
  • For daemon/server apps, use client credentials (app-only) with certificate-based authentication where possible.
  • For user-facing apps, use interactive flows that support MFA.
• For POP/IMAP/SMTP or other legacy protocols still in use, follow the guidance to authenticate them with OAuth 2.0 instead of Basic.

Because Basic authentication and app passwords are now blocked at the service level, the only viable path is to complete the migration of these applications to modern authentication (OAuth 2.0 / Microsoft Entra ID) and, where appropriate, to newer APIs such as Microsoft Graph.

References:

• Deprecation of Basic authentication in Exchange Online
• Basic authentication sign-in prompts are blocked by default in Microsoft 365 Apps
• Basic authentication is being deprecated (SharePoint Server)
• Enforce Microsoft Entra multifactor authentication with legacy applications using app passwords