Outlook Login: OAuth, IMAP & Your Delivery File

You open the delivery file, see a password and an OAuth field, and wonder which one your mail app wants. Start there—not with the import button. A file can contain valid credentials and still be the wrong format for your application.

First, check what you ordered

Our Standard Outlook format contains email and password. Full adds OAuth, client ID and recovery mail fields. Full is described at checkout for Graph API access; that description does not establish IMAP compatibility. Check the Outlook package formats against your order.

Keep the delivery file out of public chats and shared screenshots. If you ask support about its layout, send field names and a redacted example—not the live values. A token needs the same care as a password.

OAuth and IMAP are not competing choices

IMAP is a way for an app to read and synchronize mail. OAuth is how the app gets permission. You can use IMAP with OAuth; “OAuth or IMAP” mixes two different parts of the connection.

Microsoft lists OAuth2/Modern Auth for Outlook.com. Its current mail settings give these values:

Microsoft also notes that POP and IMAP access are disabled by default. Check the account’s mail settings and enable the protocol you need. Use a client that supports modern authentication rather than a password-only connection.

Test one account before a batch import

1. Confirm browser access. Open the official Microsoft sign-in page and check that you are using the exact delivered address.
2. Choose the Outlook.com account option in your app. Follow the app’s supported Microsoft sign-in flow. Read the permissions before granting access.
3. Check the connection you need. Receiving mail and sending mail are different tests. Use a test message to an inbox you control, not a campaign.
4. Save the result. Record the app version and any error, with secrets removed. Resolve a mismatch before importing more accounts.

Why a Graph token may fail in an IMAP tool

OAuth access is tied to the intended service and granted permissions. Microsoft’s protocol authentication documentation describes the permissions needed for IMAP, POP and SMTP. A field labelled “oauth” alone does not tell you its token type, audience, scope or expiry.

Ask the app vendor what it accepts, then ask store support whether the delivered format matches. Pasting a token into a password box or renaming a column does not change its permissions.

If the connection still fails

If browser access works, compare the client settings, supported authentication method and permissions. If Microsoft instead shows an account lock, stop troubleshooting server ports and follow the account-help instructions. Those are different problems, and treating them separately saves a lot of trial and error.