Oauth2 and Gnus for imap email (office365)

Does anyone have some advice for setting up gnus to read email from Office365/outlook using oauth2? My employer recently switched off basic authentication and helpfully told me to 'get a better email program' ... what could be better than emacs! It seems like emacs should be able to connect using oauth2 (e.g. https://yhetil.org/emacs-devel/87h7g5llp1.fsf@ust.hk/T/ ). I don't want to keep a local copy of all my email, so have been using gnus (which has up to now been working really nicely). This guide appears to get the authentication working https://emacs.stackexchange.com/questions/61060/how-to-make-email-in-emacs-work-with-an-oauth2-requirement but attempting to read email through gnus, I then get the helpful error message nnimap (work) open error: ‘’. Continue? (y or n) which makes debugging rather difficult. Does anyone have a working configuration for reading Office365 (or any imap email with oauth2 authentication)? Any suggestions gratefully received!

Hi. Thanks for the pointers, this may be helpful as Google will phase out in May 2022 access for "less secure" apps (like mbsync)...

May be worth looking at DavMail. That's how I solved a similar issue (for mu4e).

My work email use Okta mobile app for 2FA. Davmail works perfectly for me.

OAuth2 is not a single method. How does the authentication process work with the regular client? Many use O365Modern, which will bring up a website for you to log in (my university does) and some will lock out non-MS clients using a whitelist (my university does). So the only method for me is to (a) use the VPN to overcome the client-whitelist and authenticate with the web login - this means I also cannot use the native openconnect client, even though it does speak the protocol, and (b) use davmail as an IMAP proxy. ​ Edit: many of the OAuth2 instructions on the web require you to create an app- or tenant-id, which only the admin can do, not the user. So they are a dead end for that, unless your IT department is willing to authorise emacs. Mine were willing to authorise Thunderbird and Evolution, but I'm still waiting for the authorisation of DavMail - but it does work when I'm logged into the VPN.

Is there a list what "less secure" apps are?

Maybe app-specific passwords will continue to work with mbsync?

I've been told that, and will put it into practice these days. We will really know on May. :)

No, just anything that simply uses user/password. However, some "more secure"? access methods are cited as OAuth2...

Just use davmail

I can confirm my personal gmail account works fine with app-specific passwords. I hate digging in google's settings as much as the next guy, but https://irreal.org/blog/?p=9501 has got us covered. Only a couple minutes to switch over.

Thanks a lot, I'm on it! :+1 We will see upon May. ;P Best regards...