Creating an app password for Office 365 helps you sign in without exposing your main account password. This approach is recommended when your organization requires modern authentication and app-specific credentials to reduce risk.
Follow the steps below to generate, manage, and secure app passwords so that automated apps and legacy clients can access Office 365 services reliably.
Overview of App Passwords
| Feature | Description | Best Practice | Related Settings |
|---|---|---|---|
| Purpose | Used by apps that do not support modern authentication | Prefer OAuth or app registration over long-term app passwords | Security & compliance policies |
| Length | 16 characters, including letters and numbers | Store in a secure password manager only | Password complexity rules |
| Visibility | Shown once when created; not retrievable later | Copy it immediately and store it securely | Audit logs and sign-in activity |
| Lifespan | Long-lived until revoked manually | Rotate periodically and when devices are lost | Conditional Access and sign-in risk |
When to Use an App Password
Use an app password when a application or device cannot complete modern authentication and your admin has enabled this option for your account. Common scenarios include older desktop clients, devices without browser support, or scripts that rely on basic authentication protocols.
Before creating app passwords, verify whether your admin has enabled app passwords for your tenant and confirm that your account has permission to generate them. Modern authentication methods such as OAuth and certificate-based SSO provide stronger security and are preferred for new integrations.
Consider working with your administrator to review the balance between compatibility for legacy tools and enforcing stricter authentication policies across Office 365 services.
Generating an App Password in the Security Portal
Sign in to the Microsoft 365 security center with an account that is allowed to view and create app passwords. From your profile or security dashboard, locate the section for additional security verification options.
Navigate to the app passwords area and choose a clear label that indicates the app and device using the credential. This label helps you manage and revoke the correct password later without guessing its usage.
After generation, copy the password immediately into a secure manager and confirm that the app or client works with the new credential before closing the page.
Managing App Passwords
Track each app password by storing its label, creation date, associated app, and device in your password manager. This metadata reduces confusion when you need to rotate or remove credentials.
Revoke unused or unknown app passwords regularly to minimize the attack surface. If a device is lost or an app is replaced, generate a new password and update the configuration to use the new credential.
Coordinate with your security or IT team to define governance for app passwords, including who can create them, how long they are valid, and when they should be archived or deleted.
Troubleshooting and Best Practices
Test the app password right after creation to ensure the client signs in successfully. If the sign-in fails, verify that the password was entered exactly, including uppercase and lowercase characters, and check that the app is allowed by Conditional Access policies.
Enable multi-factor authentication for your admin and user accounts, and pair it with alerts for new app passwords. These measures reduce reliance on static credentials and improve detection of suspicious activity.
Plan periodic reviews of app passwords to align with security baselines, and document steps for users who need to replace credentials on their devices or applications.
Key Recommendations for App Passwords
- Generate a unique app password per application and device
- Store credentials only in a secure password manager
- Label passwords clearly with app name and creation date
- Revoke passwords promptly when devices are lost or apps change
- Prefer OAuth and modern authentication where supported
- Review app password usage periodically with your security team
- Enable multi-factor authentication and monitor sign-in alerts
FAQ
Reader questions
How do I create an app password for Office 365 when modern authentication is blocked?
Sign in to the Microsoft 365 security page, go to Additional security verification, choose Create a new app password, provide a helpful label, copy the generated password, and enter it in the app that requested it.
What should I do if my app password is not working in Outlook or another client?
Check for typos, ensure that the app is permitted by Conditional Access, confirm that your account is not blocked, and try generating a new app password if the old one has been rotated or revoked.
Can I reuse an old app password for multiple apps to simplify management?
Avoid reusing app passwords across apps or devices because it increases risk; instead create a unique password per app and store it securely so each credential can be revoked independently.
How often should I rotate app passwords and who can revoke them?
Rotate app passwords on a regular schedule or immediately after a device is lost, and your admin or any user with permissions can revoke unused passwords from the security portal.