G-Suite App Password Not Working in Outlook 

I had been unable to get any App Password to work in Microsoft Outlook ProPlus / Office365. Many forum postings spanning months and years discuss it but I couldn’t find any absolute proof it works, nor any explanation of why the App Passwords weren’t working in Outlook. 

The odd thing is, the App Passwords work in Windows Mail client, and I can even use the 2FA option if I tell Windows Mail it’s an IMAP account instead of a Google account. But in Outlook, the exact same App Password on the exact same computer will not work. I was on a chat with support for a very long time. I even used WireShark to get a pcap and look through the dialog between my Outlook client and the Google servers. Nothing made sense. But then I figured it out: 

Outlook for Office 365, at least version 1908 in Windows 10, does not support oAuth. 

You may be asking, “But why is that a problem? I’m using the App Password so I shouldn’t need oAuth, right?” 

Wrong. By default, the App Password feature still uses oAuth on the backend. In order for an App Password to work in Outlook, at least v1908, you must allow less-secure application authentication from the security settings within your account.  

If you’re a user, you try this link: https://support.google.com/accounts/answer/6010255

If the option for enabling LSA is missing, you have to go to your G-Suite admin, and they must follow these steps: https://support.google.com/a/answer/6260879 

However, there is a much, much better solution if your organization will allow you to modify your Office 365 Release Channel. 

If you can update to Office365 / Outlook version 2001 or later, you’ll have full, native support for oAuth 2.0, including Google’s 2-Step Authentication page. 

 

HOW TO SWITCH TO THE MONTHLY CHANNEL FOR OFFICE 365 UPDATES:

By default, if you have Office 365 ProPlus installed, you’re most likely on the Semi-Annual update channel. You need to change this to the Monthly channel.

1. Run this from an elevated command prompt: 

        “C:\Program Files\Common Files\Microsoft Shared\OfficeC2RClient.exe” /changesetting Channel=Monthly 

  1. Close any open Office products, then (re-)open Outlook again
  2. Go to
    File -> Office Account -> Update Options -> Check for Updates 
  3. Allow the updates to download and finish installing. Then move on to adding your G-Suite account below.

 

HOW TO ADD A G-SUITE ACCOUNT WITH MULTI-FACTOR AUTHENTICATION ON OUTLOOK VERSION 2001 OR LATER (see pic attached for reference):

1. In Outlook, go to 

    File -> Add Account 

  1. A new window will appear. Type your G-Suite email address, then click “Connect”
  2. TheoAuth2.0 login page for Google accounts will appear. Type your G-suite address & click “Next” 
  3. Type your normal, G-Suite password, NOT AN APP PASSWORD. If you want to avoid repeating these steps every time you launch Outlook, I’d advise checking the “Stay signed in” box.
  4. Complete your 2-step verification prompts; If you don’t want to do this every time, click the “Dontask again on this computer” box. 
  5. The permissions page will appear, displaying the access that M$ will obtain from your G-Suite info. Click “Allow.”
  6. Congrats! If all went well, you should nowhave the ability touse the new G-Suite IMAP account within Outlook! 

 

 

 

 

 

 

 

 

 

 

 

 

 

Hope this helps some of you out there! 

Ian Massey
Systems Administrator