End of Basic Authentication and Migration to Modern Authentication for Exchange Online

At Kyushu University, Information Infrastructure Initiative provides an email service named "Primary Mail Service"for students and staff members with Microsoft Office 365 Exchange Online. On September 20th, 2019, Microsoft announced the end of support for Basic Authentication for Exchange Online, which is considered vulnerable to identity leakages such as phishing and malware attacks. Microsoft would require users to use Modern Authentication such as Exchange protocol or OAuth 2.0 authorization with IMAP, POP, and SMTP. Historically we had instructed our users to use IMAP or POP and SMTP protocols for their email applications, including Microsoft Outlook and Mozilla Thunderbird, so disabling Basic Authentication would significantly impact our user population. In September 2021, Microsoft announced the end of September 2022 as the hard deadline for disabling Basic Authentication. Based on available information, we prepared migration documents from Basic Authentication to Modern Authentication and started to notify users to abandon Basic Authentication. Sending messages to users did not seem to be effective after a couple of notifications, so we tried to temporarily disable Basic Authentication to realize the remaining users through authentication failures. In this paper, we would like to share our experiences about the effect of retiring Basic Authentication for Exchange Online on our service and users.