Microsoft Exchange Online and POP3 Access

ewilson — Tue, 23 Jun 2026 14:45:44 GMT

Hi Folks,

I thought I'd post an update for anyone who makes use of the POP3/SMTP/IMAP VBO along with Exchange Online.

As you may or may not know, Microsoft has been working to remove support of older APIs and protocols from their products/platforms for some time now. Some examples include removal of the COM API from the latest Outlook client and removal of POP3 support for Delegated Access tokens from Exchange Online.

This last one can create an issue if you have digital workers currently leveraging the POP3/SMTP/IMAP VBO to interact with specific user mailboxes via Delegated Access. You can address this in one of two ways:

Switch to an Application Access token (the equivalent of a service account)
Switch to using the Graph API and our Microsoft 365 - Outlook connector (Note: The Outlook client is not actually required to use this connector).

For option #1, there are some specific steps you have to undertake to setup Exchange to permit this access. I've outlined them below:

Register Your Application w/ Exchange Online

You first need to obtain the application ID and object ID of the application registration in Entra. Go to your Azure Portal and then App registrations.
Find your specific application definition and click on it. That should bring you to the overview screen where you'll find the Object ID and Application (client) ID.
Copy those two IDs and then open a Powershell terminal and connect to your Exchange Online instance. To connect to Exchange Online from a Powershell terminal, reference the attached Microsoft link:
Connect to Exchange Online PowerShell | Microsoft Learn
Once you're Powershell terminal is connected to Exchange Online, run the following command to register your application:

New-ServicePrincipal -AppId <YOUR APP ID> -ObjectId <YOUR OBJECT ID> -DisplayName "NAME OF YOUR APP"
You can then verify the registration took place by executing this command:

Get-ServicePrincipal | fl DisplayName,AppId,ServiceId
Now, you must grant the service principal access to the specific mailbox. You do that with the following command:

Add-MailboxPermission -Identity <SPECIFIC MAILBOX ADDRESS> -User <APP OBJECT ID> -AccessRights FullAccess

At this point, you should be able to request an Application Access token, via the MSAL.NET VBO, and pass that into the POP3/SMTP/IMAP VBO, along with the mailbox address, and be able to connect to and retrieve email from said mailbox.

NOTE: These directions do not include the steps necessary to create your initial application registration in Entra. For that, refer to the user guide included with the MSAL VBO.

If you don't want to mess with the Powershell and Exchange registration steps outlined above, the better option is to switch the using the Graph API. It is Microsoft's go-to API for most things these days.

Cheers,

Eric

topic Microsoft Exchange Online and POP3 Access in Digital Exchange

Microsoft Exchange Online and POP3 Access