Basic Authentication Access for Office 365 and Google Workspace Email accounts

info Updated 27th June 2023: Customers using Office 365 or Google email services can now utilise OAuth authentication for SMTP notifications when using PaperCut MF/NG version 22.1.2 or later. What’s this about? Both Microsoft and Google are improving security for users by disabling older and less secure methods of authentication (‘Basic Authentication’ and ‘Less Secure Access’ respectively) for their cloud offerings. What’s changing, and when? What is Microsoft changing? The original announcement from Microsoft is here: Exchange Online Deprecating Basic Authentication, and there have also been follow-up emails from Microsoft to their customers. Microsoft has since published a September 2021 update announcing a new timeline for deprecating basic auth aiming for an October 2022 milestone. This link also includes an FAQ section from Microsoft which is worth reviewing for customers impacted by this. Update 21st Sept 2022: Microsoft has published a more ‘final’ version of information on Deprecation of Basic authentication in Exchange Online following their update earlier in the month: Basic Authentication Deprecation in Exchange Online – September 2022 Update. In short, Basic Auth is now switched off (as of Oct 1st, 2022) with the only lifeline being the option of a ‘One-Time Re-Enablement’ detailed in their articles. See the table below listing fix information for notifications, scan to email and email to print. What is Google changing? The original announcement from Google is here: Turning off less secure app access to G Suite (now Workspace) accounts. For completeness, Google then announced that this will be delayed until further notice. In May 2022, they advised they will stop allowing less secure apps (for non-Google-Workspace customers) as detailed in their announcement here. In September 2023, Google published their end of support information - see their Beginning September 30, 2024: third-party apps that use only a password to access Google Accounts and Google Sync will no longer be supported announcement. See the table below listing fix information for notifications, scan to email and email to print. What does this impact with PaperCut? This table outlines what product features are impacted by the changes Google and Microsoft are making to basic authentication: ImpactProduct featureFix statusImpactedEmail notifications (Microsoft): impacted if using Office 365 for SMTP.Fully fixed in version 22.1.2 - see Resolution for Email Notifications and Scan to Email below.ImpactedEmail notifications (Google): impacted if using Gmail for SMTP.Fully fixed in version 22.1.2 - see Resolution for Email Notifications and Scan to Email below.ImpactedScan to Email (Microsoft): impacted if using Office 365 for SMTP.Fully fixed in version 22.1.2 - see Resolution for Email Notifications and Scan to Email below.ImpactedScan to Email (Google): impacted if using Gmail for SMTP.Fully fixed in version 22.1.2 - see Resolution for Email Notifications and Scan to Email below.ImpactedEmail to Print (Microsoft): impacted if using Office 365 for SMTP.Fully fixed in version 22.0.0 - see Resolution for Email to Print below.ImpactedEmail to Print (Google): impacted if using Gmail for SMTP.Fully fixed in version 22.0.3 - see Resolution for Email to Print below.Not impactedScan to cloud (e.g. Scan to OneDrive, Scan to Google Drive: will not be impacted - we already use OAuth2.0.N/ANot impactedGoogle Single Sign on: will not be impacted.N/A Resolution for Email Notifications and Scan to Email If you are currently using email for notifications or scans only (i.e. you’re using it to either send system notifications or send scan-to-email emails) we recommend: With PaperCut MF/NG version 22.1.2 or later, you’ll be able to use the new Gmail with OAuth or Outlook with OAuth options, under Options > Notifications > SMTP Server Options in the PaperCut MF/NG admin interface. See Configure an SMTP server for Office 365 or Microsoft 365 using OAuth2 or Configure an SMTP server for Google using OAuth2 for more information. With PaperCut MF/NG version 22.1.1 or earlier, you’ll need to use an SMTP relay with Google Workspace or Office 365. See the next section SMTP relay set up (if you’re using version 22.1.1 or earlier) for more information. SMTP relay set up (if you’re using version 22.1.1 or earlier) Microsoft This is the recommended practice for setting up 3rd party apps (i.e. PaperCut) with these platforms, which will also allow you to disable basic auth (or not have to enable basic auth if you’re a new customer). Follow Option 3 of Microsoft’s guide: How to set up a multifunction device or application to send email using Microsoft 365 or Office 365. For the PaperCut-specific steps and configuration, refer to the Setting up a Microsoft / Office 365 SMTP Relay with PaperCut manual page. Google This is the recommended practice for setting up 3rd party apps (i.e. PaperCut) with these platforms, which will also allow you to disable basic auth (or not have to enable basic auth if you’re a new customer). Follow Google’s guide: SMTP relay: Route outgoing non-Gmail messages through Google. For the PaperCut-specific steps and configuration, refer to the Setting up a Google Workspace SMTP Relay with PaperCut manual page. info Using a free Gmail account? No Problem! For Notifications and Scan to Email, instead of SMTP relay use Google’s App Password feature. Email caps and limits Note that depending on your cloud subscription with Microsoft or Google, there may be caps or limits applied to the number of emails that can be sent through the relay (see Google and Microsoft documentation on sending limits for the relay services). Normally this is 10,000 per day - so should not be an issue, but it’s worth keeping in mind for larger or busier sites! Resolution for Email to Print If you are using the Email to Print feature, see below for the resolutions: Microsoft For Microsoft / Office 365 customers - the ability to use MS Office 365 with Email to Print (without basic auth) is available in PaperCut MF and NG version 22.0.0 and later. This is done by selecting the new IMAP OAUTH for Microsoft 365, Office 365, Outlook.com protocol from the drop down box when configuring Email to Print (see point 5 under the ‘Setting up a mailbox’ section of the Email to Print manual page). Google For Google / Workspace customers - the ability to use Gmail / Google Workspace with Email to Print (without basic auth) is available in PaperCut MF and NG version 22.0.3 and later. This id done by selecting the new Gmail OAuth2 protocol from the drop down box when configuring email to print. For more information on configuring Email to Print with Google mail see Setting Up Google OAuth2 for your Gmail account for Email to Print. Note: As an alternative for Mobile printing, you can also check out our Mobility Print product which lets you print from macOS, Windows, Android, iOS and Chromebooks. A note about 2FA Before Google and Microsoft turn off less secure apps completely, if you’re still using basic auth - but your accounts are also using 2FA - you’ll need to use an App Password instead of your regular password for your Google or Microsoft account. Google example: Setting up Email to Print with a Google Workspace account. In the information above, you’ll see that PaperCut does not yet have a fix for disabling basic auth, so you will continue to need to use email/password authentication. Instead of using your regular account password, you’d need to generate an App Password (as documented by Google) and use that in the PaperCut settings for Email to Print. Microsoft example: Setting up Email to Print with a Microsoft Office 365 account. In the information above, you’ll see that PaperCut does not yet have a fix for disabling basic auth (however this is expected to be fixed in PaperCut NG/MF v 22.0), so you will continue to need to use email/password authentication. Instead of using your regular account password, you’d need to generate an App Password (as documented by Microsoft) and use that in the PaperCut settings for Email to Print.