Microsoft Office 365 to retire basic auth support for IMAP/POP
In the second half of 2021, Microsoft will end support for basic authentication for several protocols to access Exchange Online; including the IMAP/POP3 protocols used by Pega's email listener (See Microsoft announcement here).
Impact on you:
Pega email listeners using Office365 will not be able to authenticate to Exchange Online accounts once support is discontinued.
Please note: this change will only impact email listeners using Office365/Exchange Online accounts. There is no impact on clients using any other email provider (including Microsoft Exchange on-prem), and no impact on outgoing email capabilities.
Next steps:
-
For Pega 8.4 customers using email listeners to authenticate to Exchange Online: Update any email account record that connects to an Office365 account to leverage the native MS Graph based configuration, and not IMAP or POP3. Please see this article for more details on how to configure Microsoft Graph based configuration in the email listener.
-
For customers using Pega email listener on Pega versions prior to 8.4: Please contact your account executive so we can support you in your upgrade. To help us better understand your configuration, please complete this survey (if you haven’t already) to help us understand your mail configurations so we can provide proper guidance and support.
Pegasystems Inc.
GB
Pegasystems Inc.
IN
Hello Gaurav,
Thanks for reaching out. This is a new feature altogether and can't be hotfixed. Please reach out to your account executive incase you need any help with upgrades and we are happy to help support you in your upgrade.
Thank You.
Kelly Services
US
Hello All,
We are on Pega Infiniti 8.4.3 version . We have few email accounts configured that connects to the mailbox with in our organization for processing our cases that comes via email.
My organization is migrating from IMAP authentication to OAUTH2.0 with Microsoft Graph via Microsoft O365 provider.
And Pega allows the client credentials and password credentials only if you select Microsoft Graph as receiver in the OAUTH 2.0 profile. And clearly we cannot use password credentials as Microsoft wants to come out of that approach. Hence, the left over is only client credentials which uses the access token methodology.
When we do this the scope parameter is required which Pega says its optional.
After we fix that we got the access token successful.
However, the test connectivity is still failing due to permissions issue in azure configuration. See below ,"NoPermissionsInAccessToken","message":"The token contains no permissions, or permissions cannot be understood.
Because Pega would have tested this feature before releasing it, and wondering how Pega has tested this because even after our Messaging team has provided all the permissions in their Azure app that they have created for this to connect to Pega, still we are experiencing the above error and hence kind of stuck.
At this point, we are kind of stuck and trying to see if anyone else has experienced this situation and if so, how this was resolved, any inputs is much appreciated.
Pegasystems Inc.
IN
Hello Giri,
Thanks for your question.
Based on the error it looks like the access token you are using doesn't seem to have the required permissions. I could think of two things that could have gone wrong here -
1. Please ensure that you are using token specific endpoint while acquiring the token and not the common endpoint. The token specific end point would look something like "https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token" where {tenant-id} should be replaced with the tenant-id where the mailbox is hosted. This endpoint url is configured on the OAuth2.0 authentication profile you have configured in Pega.
2. Please ensure that you did grant the admin consent on the Azure side.
If the problem still persists then please do raise an incident on the pega support portal and we will have our support team take a look into it.
Thanks.
Unitedhealth Group
US
@nvkap We are also trying to integrate with email account on Office 365 using Microsoft Graph API and while doing test connectivity, I ran into similar issue as Giri and i copying the error that I have received while doing test connectivity.
Failed while retrying to fetch accesstoken for clientID =XXXXXXXXXXXX :Access token endpoint invocation failed : {ErrorMessage=Response status : 401 Unauthorized, statuscode=401}
Soft Serve, Inc.
US
@nvkapSo I got to this link based on a different thread you posted to.
I'm a little confused by this thread, as it all seems to deal with INCOMING emails via a listener.
What about using O365 for OUTGOING emails? Our clients are on 8.5.2 and the only option is STILL by using SMTP.
Is there a workaround for that?
EIB
PL
@nvkap Have you seen this update ? https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-february-2021-update/ba-p/2111904
"we will not be disabling Basic Auth for any protocols that your tenant is using."
I think, you should inform all Pega customers about this.
Thanks.