Basic Authentication Access for Office 365 and Google Workspace Email accounts

What’s this about?

Both Microsoft and Google are improving security for users by disabling older and less secure methods of authentication (‘Basic Authentication’ and ‘Less Secure Access’ respectively) for their cloud offerings.

What’s changing, and when?

What is Microsoft changing?

The original announcement from Microsoft is here: Exchange Online Deprecating Basic Authentication, and there have also been follow-up emails from Microsoft to their customers.

Microsoft has published a September 2021 update announcing a new timeline for deprecating basic auth aiming for an October 2022 milestone (but with early 2022 testing happening from the Microsoft side). This link also includes an FAQ section from Microsoft which is worth reviewing for customers impacted by this.

What is Google changing?

The original announcement from Google is here: Turning off less secure app access to G Suite (now Workspace) accounts.

Since then, Google has announced that this will be delayed until further notice. However they have recently announced that from May 2022, they will stop allowing less secure apps (for non-Google-Workspace customers) as detailed in their announcement here. Note that they have said “this deadline does not apply to Google Workspace or Google Cloud Identity customers. The enforcement date for these customers will be announced on the Workspace blog at a later date.”

What does this impact with PaperCut?

This table outlines what product features are impacted by the changes Google and Microsoft are making to basic authentication:

ImpactProduct featureFix status
ImpactedEmail notifications (Microsoft): impacted if using Office 365 for SMTP.Fixed - see Resolution for Email Notifications and Scan to Email below.
ImpactedEmail notifications (Google): impacted if using Gmail for SMTP.Fixed - see Resolution for Email Notifications and Scan to Email below.
ImpactedScan to Email (Microsoft): impacted if using Office 365 for SMTP.Fixed - see Resolution for Email Notifications and Scan to Email below.
ImpactedScan to Email (Google): impacted if using Gmail for SMTP.Fixed - see Resolution for Email Notifications and Scan to Email below.
ImpactedEmail to Print (Microsoft): impacted if using Office 365 for SMTP.Fixed - see Resolution for Email to Print below.
ImpactedEmail to Print (Google): impacted if using Gmail for SMTP.Fixed - see Resolution for Email to Print below.
Not impactedScan to cloud (e.g. Scan to OneDrive, Scan to Google Drive: will not be impacted - we already use OAuth2.0.N/A
Not impactedGoogle Single Sign on: will not be impacted.N/A

Resolution for Email Notifications and Scan to Email

If you are currently using email for notifications or scans only (i.e. you’re using it to either send system notifications or send scan-to-email emails) we recommend using an SMTP relay with Google Workspace or Office 365.

This is the recommended practice for setting up 3rd party apps (i.e. PaperCut) with these platforms, which will also allow you to disable basic auth (or not have to enable basic auth if you’re a new customer).

Microsoft

  1. Follow Option 3 of Microsoft’s guide: How to set up a multifunction device or application to send email using Microsoft 365 or Office 365.
  2. For the PaperCut-specific steps and configuration, refer to the Setting up a Microsoft / Office 365 SMTP Relay with PaperCut manual page.

Google

  1. Follow Google’s guide: SMTP relay: Route outgoing non-Gmail messages through Google.
  2. For the PaperCut-specific steps and configuration, refer to the Setting up a Google Workspace SMTP Relay with PaperCut manual page.

Note 💡 Using a free Gmail account? No Problem! For Notifications and Scan to Email, instead of SMTP relay use Google’s App Password feature.

Email caps and limits

Note that depending on your cloud subscription with Microsoft or Google, there may be caps or limits applied to the number of emails that can be sent through the relay (see Google and Microsoft documentation on sending limits for the relay services). Normally this is 10,000 per day - so should not be an issue, but it’s worth keeping in mind for larger or busier sites!

Resolution for Email to Print

If you are using the Email to Print feature, see below for the resolutions:

Microsoft

  • For Microsoft / Office 365 customers - the ability to use MS Office 365 with Email to Print (without basic auth) is available in PaperCut MF and NG version 22.0.0 and later. This is done by selecting the new IMAP OAUTH for Microsoft 365, Office 365, Outlook.com protocol from the drop down box when configuring Email to Print (see point 5 under the ‘Setting up a mailbox’ section of the Email to Print manual page).

Google

  • For Google / Workspace customers - the ability to use Gmail / Google Workspace with Email to Print (without basic auth) is available in PaperCut MF and NG version 22.0.3 and later. This id done by selecting the new Gmail OAuth2 protocol from the drop down box when configuring email to print. For more information on configuring Email to Print with Google mail see Setting Up Google OAuth2 for your Gmail account for Email to Print.

Note: As an alternative for Mobile printing, you can also check out our Mobility Print product which lets you print from macOS, Windows, Android, iOS and Chromebooks.

A note about 2FA

Before Google and Microsoft turn off less secure apps completely, if you’re still using basic auth - but your accounts are also using 2FA - you’ll need to use an App Password instead of your regular password for your Google or Microsoft account.

Google example: Setting up Email to Print with a Google Workspace account. In the information above, you’ll see that PaperCut does not yet have a fix for disabling basic auth, so you will continue to need to use email/password authentication. Instead of using your regular account password, you’d need to generate an App Password (as documented by Google) and use that in the PaperCut settings for Email to Print.

Microsoft example: Setting up Email to Print with a Microsoft Office 365 account. In the information above, you’ll see that PaperCut does not yet have a fix for disabling basic auth (however this is expected to be fixed in PaperCut NG/MF v 22.0), so you will continue to need to use email/password authentication. Instead of using your regular account password, you’d need to generate an App Password (as documented by Microsoft) and use that in the PaperCut settings for Email to Print.


Categories: Known Issues, Authentication


Keywords: microsoft authentication, google authentication, oauth, basic access, less secure access,

Comments