Microsoft 365 Business accounts no longer support legacy App Passwords for Basic Authentication. To resolve connection issues with third-party email clients, you must enable Multi-Factor Authentication (MFA) and use modern authentication protocols like OAuth or IMAP/SMTP with app-specific credentials generated through the MFA setup wizard.
The End of Basic Authentication
For years, users could generate "App Passwords" in their Microsoft account security settings to allow older applications to connect to Outlook.com or Microsoft 365 mailboxes without triggering multi-factor authentication prompts. This feature was primarily designed to bridge the gap between legacy software and modern security standards. However, Microsoft has systematically deprecated Basic Authentication across its entire suite of services. The "App Passwords" option has been completely removed from the user interface because it is considered a significant security risk.
If you are managing your Microsoft 365 email through GoDaddy, you are likely on a Business or Enterprise plan. These plans enforce stricter security policies than personal accounts. Consequently, the legacy method of generating a static password for apps will not appear in your settings, regardless of whether you access the portal directly via login.microsoftonline.com or through the GoDaddy admin interface. Attempting to locate this missing menu item is futile because the backend service that generated these tokens has been disabled globally for business tenants.
Why Your Email Client Fails
When an email client such as Thunderbird, Apple Mail, or an older version of Outlook attempts to connect using standard username and password credentials, the server rejects the request. You may see errors indicating "Authentication Failed" or "Basic Authentication Disabled." This happens because Microsoft requires all connections to use Modern Authentication, which relies on OAuth2 tokens rather than simple password verification. This shift ensures that passwords are never transmitted in plain text during the initial handshake and allows for better monitoring of sign-in risks.
GoDaddy-hosted Microsoft 365 accounts are subject to these same tenant-wide policies. Even if your domain is managed by GoDaddy, the identity management and authentication logic reside within Microsoft’s cloud infrastructure. Therefore, any workaround involving finding a hidden setting in GoDaddy’s control panel will not restore the ability to use App Passwords. The solution lies entirely within the Microsoft security configuration for your specific user account.
Enabling Multi-Factor Authentication
The correct alternative to App Passwords is enabling Multi-Factor Authentication (MFA) and configuring your email client to support modern authentication. Most contemporary email clients handle this automatically when prompted, but some require specific configuration steps. Start by navigating to myaccount.microsoft.com and selecting the Security tab. From there, choose Advanced security options.
Look for the section labeled Additional security verification. If MFA is not already enabled, you must set it up using the Microsoft Authenticator app or SMS verification. Once MFA is active, you can generate application-specific passwords if your email client supports them, though this feature is increasingly rare. For most users, simply ensuring that MFA is turned on allows the client to perform a seamless OAuth2 handshake when you enter your main password for the first time.
- Download the Authenticator App: Install the official Microsoft Authenticator app on your mobile device.
- Add Your Account: Scan the QR code provided in the web portal to link your Microsoft 365 account.
- Verify Identity: Complete the prompt on your phone to confirm the setup.
After enabling MFA, go back to your email client. Delete the existing account profile and re-add it. When prompted for credentials, enter your full email address and password. The client should now redirect you to a browser window to authenticate via MFA, after which it will receive a secure token. This process replaces the need for static App Passwords entirely.
Configuring Third-Party Clients
Some specialized or older email clients do not support OAuth2 natively. In these cases, you might still encounter connectivity issues even after enabling MFA. If you are using a client that strictly requires a password for SMTP or IMAP, check if your organization allows "App Passwords" via the Security Defaults policy. Note that for most Microsoft 365 Business subscribers, this is disabled by default. You cannot force this on at the user level; it requires administrator intervention to create conditional access policies, which is beyond the scope of individual user settings.
Instead of fighting against Microsoft’s security model, consider switching to a client that supports modern authentication. Popular alternatives like Mozilla Thunderbird, Apple Mail (on macOS Mojave and later), and Outlook 2016 or newer handle the OAuth2 flow transparently. If you must use a legacy tool, verify if it offers an "OAuth" or "Modern Auth" toggle in its advanced network settings. Enabling this option often resolves the connection failure without needing a secondary password.
Additionally, ensure that your GoDaddy domain DNS records are correctly configured. While this does not directly affect authentication, incorrect MX or Autodiscover records can cause clients to fail to locate the correct server endpoints, leading to confusing error messages that mimic authentication failures. Check your domain’s DNS zone file to ensure all Microsoft 365 related records are present and valid.
Managing Security Settings via GoDaddy
Since you manage your email through GoDaddy, you might be accustomed to handling all settings within their dashboard. It is important to distinguish between domain management and user security. GoDaddy provides tools to manage your domain name, hosting, and sometimes basic Microsoft 365 subscription renewals. However, detailed security configurations, including MFA enforcement and authentication protocol restrictions, are handled in the Microsoft 365 Admin Center or via the user’s personal security page.
If you are an administrator for your GoDaddy-hosted Microsoft 365 tenant, you can enforce MFA for all users through the Microsoft 365 Admin Center. Navigate to Users > Active Users, select a user, and click on MFA under the More actions menu. This bulk approach ensures that no user falls back to insecure methods. For individual users, the steps outlined in the previous section remain the primary method for resolving connection issues.
Remember that disabling Basic Authentication is a permanent change driven by global security trends. Any tutorial suggesting you can re-enable App Passwords for business accounts is likely outdated or applies only to very specific, legacy enterprise environments that have opted out of these updates. For standard GoDaddy Microsoft 365 customers, MFA and Modern Authentication are the only supported paths forward.
Frequently Asked Questions
Can I re-enable App Passwords in my Microsoft 365 account?
No, Microsoft has permanently removed the ability to generate App Passwords for Business and Enterprise accounts. This feature is part of the deprecated Basic Authentication protocol and cannot be restored through user settings or GoDaddy controls.
Why does my email client ask for a password if I enabled MFA?
Your email client may be attempting to use Basic Authentication instead of Modern Authentication. Ensure your client supports OAuth2 and try removing and re-adding the account to trigger the modern authentication flow.
Does GoDaddy control Microsoft 365 security settings?
GoDaddy manages your domain registration and billing, but Microsoft controls the actual security policies, including MFA and authentication protocols. You must configure security settings directly within your Microsoft account or the Microsoft 365 Admin Center.
What should I do if my email client doesn't support OAuth2?
If your client lacks OAuth2 support, you will need to upgrade to a newer version that supports Modern Authentication. Alternatively, consider using a different email client that handles Microsoft’s security requirements natively.
Is Multi-Factor Authentication mandatory for GoDaddy Microsoft 365 users?
While not always forced by default for every single user depending on your admin's policy, it is highly recommended and often required for administrative roles. Enabling MFA is the standard replacement for App Passwords and significantly improves account security.