Server message: No supported SASL mechanism found, remote server wants: AUTH=XOAUTH2

[Snake883]

I have a Microsoft Outlook/Hotmail account. I have 2FA. I have created an application password/passphrase for my Microsoft account.

How to configure tachyon mail to use the app password?

[fahadiot]

You can't use the app password here. The error lists every AUTH method the server advertises, and for your account Outlook only offers XOAUTH2, so there is nothing Tachyon could send a password to. Microsoft moved personal Outlook/Hotmail accounts to OAuth only for third party mail apps in September 2024.

The way to do it in Tachyon is the login-o365 plugin (Office365/Outlook OAuth2). Install it from the admin panel under Extensions, then register an app in the Azure portal, add a client secret, the redirect URI and the IMAP.AccessAsUser.All, SMTP.Send, openid, offline_access, email and profile permissions. The exact list is in the header of the plugin:

Tachyon/plugins/login-o365/index.php

Lines 1 to 17 in 239c041

	<?php
	/**
	* Tachyon login-o365 plugin
	* You need to register an app in Azure portal and add
	* a secret, redirect URIs and the following API permissions:
	* https://outlook.office.com/IMAP.AccessAsUser.All
	* https://outlook.office.com/SMTP.Send
	* openid offline_access email profile
	* https://learn.microsoft.com/en-us/entra/identity-platform/reply-url#query-parameter-support-in-redirect-uris
	* Query: redirect_uri=https://{DOMAIN}/?LoginO365
	* Path: redirect_uri=https://{DOMAIN}/LoginO365
	*
	* If running behind nginx reverse proxy you might
	* need to add the following to your nginx config:
	* location = /LoginO365 {
	* return 302 /?LoginO365&$args;
	* }

In the plugin settings put the client ID and secret, and set tenant to consumers (or common) since this is a personal account. The redirect URI you register in Azure has to match your instance, either https://your.domain/LoginO365 or https://your.domain/?LoginO365 depending on the "Use /?LoginO365 redirect URI" option.

After that you log in with the Microsoft button instead of typing a password, and if Outlook is a second account you can add it from Settings, Accounts with OAuth2 too. By default the plugin only accepts outlook.com, hotmail.com and live.com addresses, there's an "Allow any domain" switch if yours is different.

[GodfreyJH]

Thank you for the detailed explanation.

I have a question regarding standard personal Outlook.com accounts.

I use a free Outlook.com account, not a Microsoft 365 business or work account, and I don't have an existing Azure application registration.

When I followed the instructions, Microsoft Entra indicated that I could no longer create applications outside a directory and suggested joining the Microsoft 365 Developer Programme or signing up for Azure. The Developer Programme page also indicates that eligibility is restricted to certain subscribers and qualifying programme members.

What is the recommended route for ordinary users with free Outlook.com accounts who simply want to connect their mailbox to Tachyon?

Is there a way to use the login-o365 extension without having to establish a separate Azure directory or obtain a Microsoft 365 developer subscription? Or is creating and configuring our own Microsoft application registration now a requirement?

I understand that Microsoft requires OAuth2, but it seems that the application-registration process could be a significant barrier for users who just want to use Tachyon with their existing personal email accounts.

Thank you for your time and for continuing to develop Tachyon.

[kimusan]

You have read Microsoft correctly and I cannot make the answer nicer than it is: an app registration is required, and it now has to live in a directory. Creating one outside a directory was removed.

What you do not need is the Developer Programme or a paid subscription. A free Azure account includes Entra ID Free, and that is enough. The sign up does ask for a card to verify identity, with nothing to pay, and that is the real friction rather than any cost.

Two things make this less of a per-user burden than the thread suggests. It is one registration for the whole Tachyon instance, done once by whoever runs the server. Everyone who signs in afterwards uses the client ID and secret from the extension settings and registers nothing themselves. If you self host for yourself alone, then it is you, once.

Your question also exposed two gaps in our own documentation, both of which would have stopped you after the directory problem:

• Supported account types must include personal Microsoft accounts. A registration that admits only organizational accounts will not let an outlook.com mailbox sign in at all.
• The two redirect URI forms are not interchangeable, and our FAQ wrongly said either would do. Microsoft permits a query parameter in a redirect URI only for work or school registrations, so a personal account must use the path form, https://YOUR-DOMAIN/LoginO365. That is the extension's default, so leave Use "/?LoginO365" redirect URI switched off. Both points are now in the FAQ.

On the obvious question, whether Tachyon could ship its own credentials so that none of this were needed, the way Thunderbird does: it cannot, and the reason is the redirect URI. Microsoft matches redirect URIs exactly and does not support wildcards for registrations that admit personal accounts, and your instance lives on your domain. A shipped client ID would only work if every installation's sign in redirected through a server that I operate, which for a self hosted mail client is not a trade I am willing to make. aerc arrives at the same place for the same reason and also tells people to register their own app.

So: free Azure account, one registration, a card for verification but no charge. If the card is itself the blocker, then the honest answer is that there is no route today to connecting a personal Outlook.com mailbox to any self hosted client, and that is Microsoft's decision rather than ours.

[GodfreyJH]

Thank you very much for taking the time to write such a detailed and informative response. I appreciate the effort you have put into explaining the situation, clarifying the requirements and updating the FAQ.

I understand the limitations involved, and I am grateful that you took the time to look into this and explain it so clearly.

Thank you again for your assistance and, above all, for the time, effort and continued dedication you put into developing Tachyon. It is an excellent application, and I thoroughly enjoy using it as my primary webmail client. Your continued development and willingness to engage with users are very much appreciated.

Keep up the excellent work, and thank you once again.