AWP Mail-Gateway: translate Basic Authentication into OAuth 2.0 automatically

The AWP Mail-Gateway is the on-premise service from AWP Consult that sits between your application and Exchange Online and translates Basic Authentication into OAuth 2.0 automatically, so that legacy applications and devices continue to work with the mailbox after the Microsoft 365 migration.

Microsoft is phasing out Basic Authentication in Microsoft 365 and moving access via IMAP, POP3 and SMTP to OAuth 2.0. However, many applications, multifunction devices and specialist systems still support only Basic Authentication and therefore lose their connection to Exchange Online. The AWP Mail-Gateway solves this problem in one place, without you having to touch each individual piece of software.

The service runs in your own environment. The application continues to speak Basic Authentication to the gateway as usual, while the gateway handles the OAuth 2.0 part towards Exchange Online. Your access credentials remain under the control of the company, the existing software stays unchanged, and the connection is set up to be future-proof.

Arrange a consultation View references

As of: October 2026 · Content reviewed by AWP Consult, certified enaio partner since 2006

Mail-GatewayExample view

Your applicationBasic Authentication

AWP Mail-GatewayBasic Auth to OAuth 2.0

Microsoft 365Exchange Online

IMAPPOP3SMTP

The connection is maintained, with no software change

250+

completed projects since 2006

150+

reference customers in the DACH region

12 to 18

months average payback period

The key points at a glance

01

The AWP Mail-Gateway is an on-premise service from AWP Consult that sits between an existing application and Exchange Online and translates Basic Authentication into OAuth 2.0 automatically, without the software needing to be adapted.

02

Microsoft is phasing out Basic Authentication in Microsoft 365 and moving access via the mail protocols IMAP, POP3 and SMTP to OAuth 2.0.

03

Many legacy applications and devices support only Basic Authentication and therefore lose their connection to Exchange Online. The gateway keeps this connection alive.

04

The service supports the IMAP, POP3 and SMTP protocols and therefore covers both the retrieval and the sending of messages.

05

The gateway runs in the company's own environment, the access credentials remain under its control and never leave the premises.

06

The benefit: legacy applications and devices remain usable, no software change is needed, and the connection to Microsoft 365 is future-proof.

Would you like to see this with your own documents?

Request a live demo +49 6104 94738-13

What is the AWP Mail-Gateway?

The AWP Mail-Gateway is an on-premise service from AWP Consult that intercepts the Microsoft 365 migration to modern authentication. It receives the connection from an application via Basic Authentication and converts it to OAuth 2.0 towards Exchange Online. For the connected software nothing changes: it continues to log in to the gateway with a username and password, while the gateway carries out the modern sign-in process against Microsoft 365. In this way, applications and devices that do not make the switch themselves remain usable.

Image

01

On-premise service

The gateway runs in your own environment, not in a third-party cloud. This keeps the mailbox access credentials and the data flow under the control of the company, so they never leave the premises.

02

Translation of the sign-in

The application speaks Basic Authentication, the gateway speaks OAuth 2.0. The gateway translates between the two worlds, so that a legacy sign-in arrives at a modern interface.

03

IMAP, POP3 and SMTP protocols

The service covers the classic mail protocols for retrieval and sending. IMAP and POP3 fetch messages from the mailbox, SMTP sends them, in each case via Exchange Online.

04

No software change

No intervention is needed on the existing application. Instead of rebuilding each system individually, the migration is solved at one central point, which is particularly helpful with legacy applications that receive no updates.

Have your affected applications documented

We will review which of your applications and devices currently access Exchange Online via Basic Authentication, and show you how the AWP Mail-Gateway keeps them connected after the migration.

Arrange a consultation +49 6104 94738-13

What changes when Basic Authentication is switched off?

When Basic Authentication is switched off, little appears to change for the user, but a great deal changes fundamentally in the technology behind it: the mailbox will in future require a modern, token-based sign-in via OAuth 2.0, while older applications continue to send only a username and password. This is precisely the gap the AWP Mail-Gateway addresses. The following comparison shows what happens without and with the gateway.

Graphic

Criterion	Without AWP Mail-Gateway	With AWP Mail-Gateway
Application sign-in	Basic Authentication is rejected by Exchange Online	The application continues to sign in to the gateway via Basic Authentication
Sign-in against Microsoft 365	None, the connection breaks off	The gateway carries out the OAuth 2.0 sign-in against Exchange Online
Effort on the software	Each application would have to be rebuilt or replaced individually	No software change, the migration sits with the gateway
Legacy applications and devices	No longer usable without an update for modern sign-in	Remain usable via the gateway
Access credentials	Would have to be stored and maintained per system	Remain in your own environment, under the control of the company
Protocols	IMAP, POP3 and SMTP blocked without modern sign-in	IMAP, POP3 and SMTP for retrieval and sending remain available

The gateway affects only the sign-in and the transport path. The content and structure of the messages remain unchanged.

Do you have a specific question about your situation?

Ask a question View references

How does the AWP Mail-Gateway work step by step?

The AWP Mail-Gateway works in five steps: the application connects to the gateway via Basic Authentication, the gateway checks the request, obtains an OAuth 2.0 token from Microsoft 365 in the background, uses it to establish the connection to Exchange Online, and passes retrieval or sending through via IMAP, POP3 or SMTP. The process remains invisible to the application, which carries on working as usual.

Animation

01

The application connects via Basic Authentication

The existing application or device connects as before with a username and password, only no longer directly to Microsoft 365, but to the AWP Mail-Gateway in your environment. Nothing changes in the application's configuration apart from the target server.

02

The gateway receives the request and checks it

The gateway accepts the connection, assigns it to the correct mailbox and verifies that only permitted applications and mailboxes are served. In this way access remains controlled, even though the application itself cannot perform a modern sign-in.

03

The gateway obtains an OAuth 2.0 token

In the background, the gateway carries out the modern sign-in and obtains a time-limited access token under OAuth 2.0 from Microsoft 365. This token takes the place of the password towards Exchange Online and is renewed automatically when it expires.

04

Establish the connection to Exchange Online

Using the token, the gateway establishes the encrypted connection to Exchange Online. To Microsoft 365, the access looks like that of a modern, registered application, because the gateway takes on precisely this role.

05

Pass retrieval or sending through

The gateway passes the request through via the appropriate protocol: IMAP or POP3 for retrieving messages, SMTP for sending. The result travels back to the application the same way, and the application continues to believe it is speaking directly to a classic mail server.

Which applications in your organisation depend on Basic Authentication? In a workshop we document mailboxes, protocols and devices.

Arrange a consultation

How does AWP Consult deploy the AWP Mail-Gateway?

AWP Consult deploys the AWP Mail-Gateway by documenting the affected applications and devices, putting the switch-off of Basic Authentication in Microsoft 365 into context, setting up the modern sign-in via OAuth 2.0, connecting the IMAP, POP3 and SMTP protocols for retrieval and sending, and securing operation in your own environment. In this way the existing software stays unchanged, while the connection to Exchange Online becomes future-proof.

Design the AWP Mail-Gateway for your systems

We clarify which applications and devices are affected, which mailboxes and protocols they use and how the gateway is operated in your environment.

Arrange a consultation +49 6104 94738-13

01

Why Microsoft is switching off Basic Authentication

Basic Authentication means that an application sends a username and password in clear text with the sign-in on every connection. This method can easily be intercepted and allows no additional safeguard such as multi-factor sign-in. For this reason, Microsoft is phasing out Basic Authentication in Microsoft 365 and moving access via IMAP, POP3 and SMTP to OAuth 2.0:

In terms of security, this step is right. The problem only arises where an application does not support the modern sign-in and receives no update for it. We cover the broader security questions around enaio under Security and permissions.

Basic AuthenticationThe application sends a username and password directly. An intercepted password grants full access, and a second layer of protection is not possible.
OAuth 2.0After a single, secured sign-in, the application receives a time-limited token. The password itself is no longer transmitted on every connection.
Microsoft 365 migrationThe change concerns the access protocols for email and has been running in stages for several years. Applications without a modern sign-in lose their connection in the process.

Practical tip

Identify early on which applications have stored an unencrypted mailbox password. These are precisely the ones affected by the switch-off and often the hardest to change individually.

02

How OAuth 2.0 replaces the sign-in

OAuth 2.0 is the established framework for delegated, token-based access, described in the standard RFC 6749. In place of the password, an access token is used, which a registered application receives after a secured sign-in. The AWP Mail-Gateway takes on precisely this role of the registered application towards Exchange Online:

This turns an old sign-in into modern access, without the application itself having to support OAuth 2.0. The fundamentals of the method are set out in RFC 6749, which we reference under the sources.

Registered applicationThe gateway is stored in Microsoft 365 as an application and may access mailboxes within a defined scope. The access can be viewed and revoked there at any time.
Access tokenThe token is time-limited and applies only to the agreed purpose. It is renewed automatically when it expires, without anyone having to intervene.
Separation of password and accessThe connected application still knows only its password towards the gateway. The modern token towards Microsoft 365 is managed solely by the gateway.

Practical tip

Set up a dedicated application account for the gateway with exactly the rights it needs. The tighter the scope, the smaller the damage if an account is compromised.

03

IMAP, POP3 and SMTP: retrieval and sending

An application's email traffic runs over three classic protocols, all of which the AWP Mail-Gateway covers. This keeps both the retrieval and the sending of messages intact:

Because the gateway covers the IMAP, POP3 and SMTP protocols together, an application's complete mail traffic is preserved, not just retrieval or just sending. For orderly document intake, this is followed by AWP SmartFlow, which processes emails automatically.

IMAPThe Internet Message Access Protocol retrieves messages and leaves them on the server, with folders and status. It is suitable when several points of access should see the same mailbox state.
POP3The Post Office Protocol version 3 fetches messages from the mailbox, typically for local further processing. It is used when an application collects messages and manages them itself.
SMTPThe Simple Mail Transfer Protocol sends messages. Via SMTP the application delivers, for example for automatic notifications, invoices or reports from a specialist system.

Practical tip

For each application, check whether it only retrieves, only sends or does both. A multifunction device often uses SMTP alone, whereas an archiving service uses IMAP or POP3.

04

On-premise operation and protection of the access credentials

Operating the gateway in your own environment is a deliberate choice. It keeps the sensitive parts of the access in-house and makes the path traceable:

In this way, control over the access stays where the responsibility lies. If you also want to store documents in encrypted form, you will find the right component under CipherMate.

Own environmentThe gateway runs on your systems. The mail traffic between the application and the gateway does not leave the internal network, and only the gateway speaks externally to Exchange Online.
Access credentials under controlThe mailbox sign-in and the modern token reside in the gateway in your environment. Access credentials are not outsourced to an external service.
TraceabilityWhich application accessed which mailbox and when can be traced centrally at the gateway, rather than being scattered across many individual systems.

Practical tip

Operate the gateway in a secured network segment and restrict which applications are allowed to reach it at all. This prevents the central point from becoming an open door.

05

Positioning within the system landscape

The AWP Mail-Gateway is not a replacement for an application, but a connecting element. It sits between existing systems and Microsoft 365 and fits into a larger enaio and specialist-system landscape:

In this way the gateway fits into your system landscape without rebuilding it. How enaio is connected to SAP, DATEV and Microsoft Dynamics 365 is described on the page about the enaio interfaces.

Legacy applicationsSpecialist applications without an update path that retrieve or send email keep their mailbox connection via the gateway, instead of having to be replaced.
DevicesMultifunction devices and scanners that send documents via SMTP remain usable, even if their firmware does not support a modern sign-in.
Specialist systemsERP, archiving and document systems that exchange notifications or receipts by mail stay connected, without their mail sending being rebuilt.

We will show you how this looks with enaio in your organisation.

Arrange an appointment +49 6104 94738-13

What does the AWP Mail-Gateway work with?

The AWP Mail-Gateway is designed as a connecting element between existing systems and Microsoft 365. It serves applications and devices that support only Basic Authentication and connects them to Exchange Online. In this way the email traffic via IMAP, POP3 and SMTP is preserved, while the actual sign-in runs in a modern way via OAuth 2.0.

Image

Exchange Online

The mailbox in Microsoft 365, towards which the gateway carries out the modern sign-in via OAuth 2.0 and maintains access.

Security

Legacy applications

Specialist applications without an update path that continue to work via Basic Authentication and remain connected via the gateway.

Solutions with enaio

AWP SmartFlow

The central processing of incoming documents, which hands retrieved emails to enaio workflows in an orderly way.

AWP SmartFlow

AWP Import GUI

The quick filing of emails and files in enaio, which complements the path from the mailbox into the file.

AWP Import GUI

Would you rather clarify things in person than read on?

Request a callback +49 6104 94738-13

Which mistakes happen during the migration from Basic Authentication?

The most common mistakes during the migration from Basic Authentication to OAuth 2.0 are starting too late, an incomplete inventory of the affected systems, overlooking devices, access rights that are too broadly defined, a gateway acting as an open passage, and operation without monitoring. None of them is due to the method, and all of them can be avoided in the concept.

Waiting for the connection to break off first

Consequence: Applications fail without warning when the switch-off takes effect, and operations come to a standstill.
Better: Document the affected systems before each switch-off date and connect them via the gateway.

Recording only the obvious applications

Consequence: Scanners, secondary systems and scripts that quietly send via SMTP are forgotten and break off later.
Better: Record all mailbox access systematically, including devices and automatic senders.

Overlooking multifunction devices

Consequence: Devices without a modern sign-in can suddenly no longer send scans by mail.
Better: Check devices early and route their SMTP sending via the gateway, instead of bypassing the firmware.

Granting rights that are too broad

Consequence: A gateway account with full mailbox access increases the damage in the event of misuse.
Better: Give the gateway only the necessary rights per mailbox and protocol, and keep the scope tight.

Operating the gateway without access protection

Consequence: If every internal application can reach the gateway, the central point becomes a risk.
Better: Restrict access to permitted applications and a secured network segment.

Not monitoring operations

Consequence: Expired tokens or blocked accounts only come to light through complaints.
Better: Monitor connections and tokens centrally at the gateway and make faults visible early.

Plan your migration to OAuth 2.0

We document the affected applications and devices and show how the AWP Mail-Gateway migrates Basic Authentication to OAuth 2.0, without you having to change your software.

For IMAP, POP3 and SMTP
No software change
In on-premise operation

Request a consultation +49 6104 94738-13Mon to Fri 08:30 to 17:00

Conclusion

Stay connected after the Microsoft 365 migration

The AWP Mail-Gateway translates Basic Authentication into OAuth 2.0 and keeps your applications connected to Exchange Online even after the Microsoft 365 migration. In this way mailbox access and mail processes continue to run, without every single application having to be rebuilt.

Basic Authentication is translated into OAuth 2.0
Applications remain connected to Exchange Online
No individual rebuilds after the Microsoft 365 migration
IMAP, POP3 and SMTP remain usable
Adapted to your mail connection by AWP Consult

Which terms around the AWP Mail-Gateway should you know?

The key terms that come up again and again in projects around the AWP Mail-Gateway and the Microsoft 365 migration.

AWP Mail-Gateway: On-premise service from AWP Consult that sits between an application and Exchange Online and translates Basic Authentication into OAuth 2.0 automatically, with no software change.
Basic Authentication: A sign-in method in which an application sends a username and password directly on every connection. Microsoft is phasing it out in Microsoft 365.
OAuth 2.0: A standardised framework for token-based access under RFC 6749. In place of the password, a time-limited access token is used.
Exchange Online: The email service in Microsoft 365 that provides the mailboxes and moves access via IMAP, POP3 and SMTP to a modern sign-in.
Microsoft 365: Microsoft's cloud platform, which includes Exchange Online and in which Basic Authentication is being phased out in stages.
IMAP: Internet Message Access Protocol, a protocol for retrieving emails that leaves messages on the server with folders and status.
POP3: Post Office Protocol version 3, a protocol for retrieving emails from a mailbox, usually for local further processing.
SMTP: Simple Mail Transfer Protocol, the protocol for sending emails, for example by devices and specialist systems.
Access token: A time-limited proof that a registered application receives after an OAuth 2.0 sign-in and that replaces the password towards the service.
On-premise: Operating software in the company's own environment rather than in a third-party cloud, so that access credentials and the data flow remain in-house.
Modern authentication: A collective term for sign-in methods based on OAuth 2.0 and tokens, as opposed to the direct transmission of a username and password.

Unsure where to start? We will put your starting position into context.

Arrange an initial conversation View references

Sources and legal bases

The technical statements on this page are based on these official and established sources. As of November 2026.

Microsoft: Deprecation of Basic authentication in Exchange Online Switch-off of Basic Authentication and migration to modern sign-in
Microsoft: Authenticate an IMAP, POP or SMTP connection using OAuth OAuth 2.0 for the IMAP, POP3 and SMTP protocols in Exchange Online
IETF RFC 6749: The OAuth 2.0 Authorization Framework The standard that describes the token-based OAuth 2.0 method
Microsoft: Exchange Online Basic Auth deprecation announcement Timeline and scope of the switch-off of Basic Authentication
BSI: Email security Fundamentals of secure sign-in and transmission of email

Frequently asked questions about the AWP Mail-Gateway

What is the AWP Mail-Gateway?

The AWP Mail-Gateway is an on-premise service from AWP Consult that sits between an existing application and Exchange Online and translates Basic Authentication into OAuth 2.0 automatically. In this way legacy applications and devices remain usable after the Microsoft 365 migration, without the software having to be changed. The service supports the IMAP, POP3 and SMTP protocols for retrieval and sending.

Why do applications lose their connection to Exchange Online?

Microsoft is phasing out Basic Authentication in Microsoft 365 and moving access via IMAP, POP3 and SMTP to OAuth 2.0. Applications and devices that support only Basic Authentication and receive no update for the modern sign-in are rejected by Exchange Online and therefore lose their connection to the mailbox.

How does the AWP Mail-Gateway translate Basic Authentication into OAuth 2.0?

The application continues to sign in to the gateway via Basic Authentication. In the background, the gateway obtains a time-limited access token under OAuth 2.0 from Microsoft 365 and uses it to establish the connection to Exchange Online. The process remains invisible to the application, and to Microsoft 365 the access looks like that of a modern, registered application.

Do I have to change my software?

No. The AWP Mail-Gateway is designed precisely so that no software change is needed on the existing application. Apart from the target server, which now points to the gateway, the configuration stays the same. This is particularly helpful where legacy applications have no update path for modern authentication.

Which protocols does the AWP Mail-Gateway support?

The gateway covers the IMAP, POP3 and SMTP protocols. IMAP and POP3 serve to retrieve messages from the mailbox, SMTP to send them. This keeps an application's complete email traffic intact, both receiving and sending via Exchange Online.

Where do the access credentials reside with the AWP Mail-Gateway?

The gateway runs in your own environment, not in a third-party cloud. The mailbox sign-in and the modern token stay in the gateway and therefore under the control of the company. Access credentials are not outsourced to an external service, and the mail traffic between the application and the gateway does not leave the internal network.

What is OAuth 2.0 and why is it more secure?

OAuth 2.0 is a standardised framework for token-based access, described in RFC 6749. Instead of sending a username and password on every connection, a registered application receives a time-limited token after a secured sign-in. An intercepted token is valid only for a limited time, and the access can be viewed and revoked in Microsoft 365 at any time.

Does the Microsoft 365 migration also affect multifunction devices?

Yes. Scanners and multifunction devices that send documents via SMTP to a mailbox often use only Basic Authentication and have no modern firmware. They are affected by the switch-off just as much as specialist applications. Via the AWP Mail-Gateway they keep their SMTP sending, without the firmware having to be changed.

When should I introduce the AWP Mail-Gateway?

Before the respective switch-off date of the affected access. The Microsoft 365 migration is running in stages, and as soon as Basic Authentication is switched off for a protocol, the affected application fails without a replacement. It makes sense to document the affected systems early and connect them via the gateway in good time.

Which systems benefit from the AWP Mail-Gateway?

Above all legacy applications without an update path, specialist systems that exchange notifications or receipts by mail, and devices such as scanners and multifunction devices. Wherever a system supports only Basic Authentication but should continue to work with Exchange Online, the gateway keeps the connection alive.

How does the AWP Mail-Gateway fit with enaio?

The gateway keeps applications and devices connected to Exchange Online, which then often feed into enaio processes. Retrieved emails can be processed further in an orderly way with AWP SmartFlow, and AWP Import GUI handles the quick filing. AWP Consult is a certified enaio partner in the DACH region and supports the connection from over 250 completed projects since 2006.

Is the AWP Mail-Gateway a permanent solution?

It is a future-proof connection for systems that cannot make the switch themselves. The gateway carries out the modern sign-in towards Microsoft 365 and remains in place even when Basic Authentication is switched off completely. Where an application later does support OAuth 2.0 itself, the connection can be adjusted at any time.

Sounds right for your company? Let us talk about it.

Request a consultation +49 6104 94738-13

Relevant topics that save real money

AWP SmartFlowProcess incoming documents centrally and hand them to enaio workflows.AWP Import GUIFile emails and files quickly in enaio.CipherMateStore sensitive documents in the DMS in encrypted form.enaio interfacesConnection to SAP, DATEV and Microsoft Dynamics 365.

Your connection to Microsoft 365, set up to be future-proof

In a workshop we document your affected applications, devices, mailboxes and protocols and show how the AWP Mail-Gateway migrates Basic Authentication to OAuth 2.0, without you having to change your software. You see the path on your own systems, not on a demo with sample data.

Arrange a consultation