Microsoft is disabling Basic authentication for most Exchange Online protocols (IMAP, POP, EWS), meaning apps can no longer send a username and password with every request. SMTP AUTH is an exception but will be disabled by default for existing tenants by the end of 2026.