Sync to Hotmail (Outlook) account fails with "Wrong username or password"

Vampire337

I’ve set up Mailcow in a docker container, logged into sogo and my first test is to pull mail from my Hotmail account. I generated an app password, entered “outlook.office365.com” and port 993, my email as the user name and the app password, encryption is “SSL” even tho technically Outlook says to use “SSL/TLS”. All set up and… “Wrong username or password.”

Well, I knew that wasn’t true so I tried again with another app password, same error. I disabled passwordless login and created a password; that didn’t help. I’ve disabled two factor authentication and that didn’t help. I’m able to log into my Hotmail account in a guest session in my browser with the email and newly-created password, but Mailcow isn’t having it. What might I be missing, or where do I go to figure out what it’s not happy with?

ETNyx

Hello,

are you able log in using https://www.thunderbird.net?

Check your logs if you see login request and password failure.

Vampire337

Thanks for the reply. I am able to log in and view mail using Thunderbird, but it auto-detects OAuth as the method and opens a popup window. If I tell it to use encrypted password it gives me the same error, although I just used the same password to log into the Outlook site, so I’m absolutely sure the credentials themselves are valid. Is there a way to use OAuth for the mailcow sync?

Here is the log output (emails removed):
Docker context detected with the file /.dockerenv No log by default in Docker context. Use --log to trigger logging to the logfile. Changing current directory to /var/tmp/uid_65534 Here is imapsync 2.178 on host 7ad150d1747a, a linux system with 4.5/7.9 free GiB of RAM with Perl 5.40.1 and Mail::IMAPClient 3.43 Transfer started at Monday 3 November 2025-11-03 07:14:36 -0500 EST PID is 30799 my PPID is 30778 No log file because of option --nolog Load is 0.23 0.13 0.10 1/832 on 4 cores Current directory is /var/tmp/uid_65534 Real user id is nobody (uid 65534) Effective user id is nobody (euid 65534) $RCSfile: imapsync,v $ $Revision: 2.178 $ $Date: 2022/01/12 21:28:37 $ Command line used, run by perl: /usr/local/bin/imapsync --tmpdir /tmp --nofoldersizes --addheader --exclude (?i)spam|(?i)junk --subfolder2 myemail@hotmail.com --maxage 7 --delete2duplicates --subscribeall --automap --ssl1 --host1 outlook.office365.com --user1 myemail@hotmail.com --passfile1 /tmp/imapsync.E76yagO --port1 993 --host2 localhost --user2 myaccount@localdomain.com*pjkuga9pfok9wpgy@mailcow.local --passfile2 /tmp/imapsync.xADHdyQ --no-modulesversion --noreleasecheck Temp directory is /tmp ( to change it use --tmpdir dirpath ) Under docker context so installing only signals to exit kill -INT 30799 # special behavior: call to sub catch_exit kill -QUIT 30799 # special behavior: call to sub catch_exit kill -TERM 30799 # special behavior: call to sub catch_exit No variable pid_filename PID file is unset ( to set it, use --pidfile filepath ; to avoid it use --pidfile "" ) Info: will resync flags for already transferred messages. Use --noresyncflags to not resync flags. Host2: probing ssl on port 993 ( use --nosslcheck to avoid this ssl probe ) Host2: sslcheck detected open ssl port 993 so turning ssl on (use --nossl2 --notls2 to turn off SSL and TLS wizardry) SSL debug mode level is --debugssl 1 (can be set from 0 meaning no debug to 4 meaning max debug) Host1: SSL default mode is like --sslargs1 "SSL_verify_mode=0", meaning for host1 SSL_VERIFY_NONE, ie, do not check the certificate server. Host1: Use --sslargs1 SSL_verify_mode=1 to have SSL_VERIFY_PEER, ie, check the certificate server of host1 Host2: SSL default mode is like --sslargs2 "SSL_verify_mode=0", meaning for host2 SSL_VERIFY_NONE, ie, do not check the certificate server. Host2: Use --sslargs2 SSL_verify_mode=1 to have SSL_VERIFY_PEER, ie, check the certificate server of host2 Info: will act as --uidexpunge2 Info: turned ON syncinternaldates, will set the internal dates (arrival dates) on host2 same as host1. Host1: will try to use LOGIN authentication on host1 Host2: will try to use LOGIN authentication on host2 Host1: imap connection timeout is 120 seconds Host2: imap connection timeout is 120 seconds Host1: imap connection keepalive is on on host1. Use --nokeepalive1 to disable it. Host2: imap connection keepalive is on on host2. Use --nokeepalive2 to disable it. Host1: IMAP server [outlook.office365.com] port [993] user [myemail@hotmail.com] Host2: IMAP server [localhost] port [993] user [myaccount.localdomain.com*pjkuga9pfok9wpgy@mailcow.local] Host1: connecting and login on host1 [outlook.office365.com] port [993] with user [myemail@hotmail.com] Host1 IP address: 52.96.157.50 Host1 banner: * OK The Microsoft Exchange IMAP4 service is ready. [QwBIADUAUABSADAAMgBDAEEAMAAwADEAMAAuAG4AYQBtAHAAcgBkADAAMgAuAHAAcgBvAGQALgBvAHUAdABsAG8AbwBrAC4AYwBvAG0A] Host1 capability before authentication: IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS MOVE ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+ AUTH Host1 info: authmech [LOGIN] user [myemail@hotmail.com] authuser [] IsUnconnected [] Host1 failure: Error login on [outlook.office365.com] with user [myemail@hotmail.com] auth [LOGIN]: 2 NO LOGIN failed. Host1: failed login on [outlook.office365.com] with user [myemail@hotmail.com] auth [LOGIN] Host2: connecting and login on host2 [localhost] port [993] with user [myaccount.localdomain.com*pjkuga9pfok9wpgy@mailcow.local] Host2 IP address: ::1 Host2 banner: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot ready. Host2 capability before authentication: IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN AUTH Host2: localhost says it has CAPABILITY for AUTHENTICATE LOGIN Host2: success login on [localhost] with user [myaccount.localdomain.com*pjkuga9pfok9wpgy@mailcow.local] auth [LOGIN] or [LOGIN] ++++ Listing 1 errors encountered during the sync ( avoid this listing with --noerrorsdump ). Err 1/1: Host1 failure: Error login on [outlook.office365.com] with user [myemail@hotmail.com] auth [LOGIN]: 2 NO LOGIN failed. The most frequent error is ERR_AUTHENTICATION_FAILURE_USER1. Check the credentials for myemail@hotmail.com. Exiting with return value 161 (EXIT_AUTHENTICATION_FAILURE_USER1) 1/50 nb_errors/max_errors PID 30799 Disconnecting from host2 localhost user2 myaccount.localdomain.com*pjkuga9pfok9wpgy@mailcow.local No log file because of option --nolog

ETNyx

Ok, now it’s much more clear, problem is not a password but authentication method. Outlook server does not accept LOGIN method

see this file https://imapsync.lamiral.info/FAQ.d/FAQ.Office365.txt
and this https://imapsync.lamiral.info/oauth2/oauth2_imap/README_oauth2.txt

Vampire337

Thanks for the links. I was pretty sure it was something I didn’t know to do but wasn’t sure how to formulate a good question.

There’s a lot to unpack in there. Those links mention a lot about Azure accounts and Exchange/OWA, which doesn’t apply or doesn’t exist for me. Am I understanding correctly that I need to install imapsync somewhere in my containers, or is it already there and I need to configure (differently) it somewhere in mailcow?

ETNyx

MC sync is imapsync under the hood (in your logs,… /usr/local/bin/imapsync).

Sorry, I never need syncing MS stuff and MC so I do not exactly know to to get it done. First check
Q. How to sync from Office365 to XXX? or Q. How to sync from XXX to Office365

esackbauer

I guess @Vampire337 tried to pull Outlook mails via SOGos configuration. However that only supports classic Login, not Oauth.
So the only way would be to set up imapsync (a sync job in mailcow UI), which I also did not do, because its too much of an hassle. I would say forget about it, use Thunderbird for Outlook 😉
Mailcow is not a mail aggregator for different mail providers. It provides mailing and groupware for your own domain.