Why does Outlook 2013 suddenly stop connecting to Exchange Online after a tenant-wide security update? Why do some users get prompted for credentials every 15 minutes while others log in once and stay signed in? Why does the same Office 365 account work fine in Outlook Web App but fail silently in Outlook 2013?
The answer isn’t ‘it’s broken’ — it’s that Outlook 2013 was built before modern authentication existed. Microsoft added patchy, limited support later. But only if you install the right updates, configure registry keys, and disable certain tenant-level policies. And even then, it’s fragile.
The Short Version
| Method | Pros | Cons | Requires Admin Access? |
|---|---|---|---|
| KB2965295 + Registry Key (EnableADAL) | Works with MFA-enabled accounts in most hybrid scenarios | Fails with Conditional Access policies requiring device compliance | Yes — local admin or GPO |
| Basic Auth Fallback (tenant-level) | No client changes needed. Works immediately. | Disabled by default in new tenants as of Oct 2022. Violates Microsoft’s security baseline. | Yes — Azure AD admin portal |
| Upgrade to Outlook 2016 or later | Native, full modern auth support. No registry hacks. Works with CA, MFA, Intune enrollment. | Requires license upgrade and desktop rollout. Not feasible for locked-down environments. | No — end-user action only |
| Use Outlook on the web (OWA) | Always uses modern auth. Zero client config. | No offline mode. No rules, no VBA, no PST archiving. | No |
Method 1: KB2965295 + Registry Key (EnableADAL)
This is the only way Outlook 2013 talks to Azure AD using OAuth 2.0. It’s not ‘enabled by default’. You must install KB2965295 (released April 2014), then manually set a registry DWORD.
Do this: Download KB2965295 from Microsoft Update Catalog. Install it. Then open regedit. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Identity. Create a new DWORD named EnableADAL. Set its value to 1.
Restart Outlook. Go to File > Account Settings > Account Settings. Double-click your Exchange account. Click Change. If modern auth is active, you’ll see “Connect to Microsoft Exchange using modern authentication” checked — and the password field will be grayed out.
It fails if your tenant enforces Conditional Access policies like ‘Require compliant device’ or ‘Require approved client app’. Outlook 2013 can’t report device compliance status. So it gets stuck in a loop: authenticate → get token → fail device check → retry → repeat.
Also fails if your organization uses Azure AD Application Proxy for on-prem Exchange — because ADAL in Outlook 2013 doesn’t handle proxy headers correctly.
Method 2: Basic Auth Fallback (tenant-level)
This isn’t a client fix — it’s a tenant rollback. Microsoft disabled basic authentication globally for Exchange Online in October 2022. But admins can re-enable it per protocol (POP, IMAP, SMTP, EWS) via PowerShell.
Run this as a Global Admin:Set-OrganizationConfig -OAuth2ClientProfileEnabled $false
Then, for each protocol needing fallback:Set-AuthenticationPolicy -Identity "Default Policy" -AllowBasicAuthPop $true -AllowBasicAuthImap $true
This lets Outlook 2013 connect using username/password over HTTPS — no MFA, no tokens, no SSO. It works. But it violates Microsoft’s own security baseline. And it won’t survive Microsoft’s next enforcement wave — they’ve said basic auth will be fully retired.
Group Policy doesn’t control this. Only Azure AD admin roles matter. Your IT team needs Global Administrator or Exchange Administrator access in the Microsoft 365 admin center.
Don’t bother testing this in a dev tenant. New tenants created after August 2021 don’t even expose the OAuth2ClientProfileEnabled setting — it’s hardcoded to $true.
Method 3: Upgrade to Outlook 2016 or later
Outlook 2016 (version 16.0.4266.1001+) supports modern authentication natively — no KBs, no registry edits, no PowerShell flags. It ships with ADAL pre-enabled and handles device compliance claims correctly.
Go to File > Office Account > Update Options > Update Now. If you’re on Click-to-Run (most Microsoft 365 subscriptions), you’ll get Outlook 2016+ automatically — unless your org blocks updates via Group Policy (Computer Configuration\Policies\Administrative Templates\Microsoft Office 2016\Updates).
Here’s the counterintuitive part: Outlook 2013 users on Windows 7 SP1 *can* run Outlook 2016. Microsoft officially supports it. Don’t assume legacy OS = legacy Outlook.
Outlook 2019 and Microsoft 365 Apps go further: they support brokered authentication (Windows Hello, certificate-based auth). Outlook 2013 cannot do any of that — ever.
If your company uses Intune or ConfigMgr, push Outlook 2016+ as a required deployment. Don’t waste time debugging registry keys when the real fix is two clicks in the admin center.
Which Should You Choose?
Ask yourself these four questions — in order:
- Is your tenant created before August 2021?
- Do you have Global Admin rights to run PowerShell commands?
- Is your desktop environment locked down so tightly that installing Outlook 2016 triggers a change-control review?
- Are you supporting users who rely on Outlook 2013-specific features (e.g., custom VBA macros that break in newer versions)?
If you answered “yes” to #1 and #2, try Method 2 first — it’s fastest. If you said “no” to #2 but “yes” to #3, use Method 1 — but test thoroughly with Conditional Access enabled. If you said “no” to #3, skip straight to Method 3. That’s where 92% of our clients land.
One last reality check: Outlook 2013 mainstream support ended April 10, 2018. Extended support ended April 11, 2023. It no longer receives security updates. Running it on a domain-connected machine today is a compliance red flag — especially in finance or healthcare.
| Action | Shortcut | Alt Sequence | Notes |
|---|---|---|---|
| Open Account Settings | Ctrl+Shift+A | Alt+F+A | Works in all Outlook 2013–2021 versions |
| Check current auth method | None — must view connection status | Alt+H+Q, then click 'Connection Status' | Look for 'Auth=Bearer' (modern) vs 'Auth=NTLM' (basic) |
| Force Outlook to re-authenticate | Ctrl+Alt+R | Alt+F+T → select account → 'Remove' | Removes cached token. Triggers fresh auth flow. |
| View registry identity key | Win+R → regedit | None | Navigate to HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Identity |
| Test connection with modern auth | Ctrl+Shift+U | Alt+F+T → 'Test Account Settings' | If modern auth works, you’ll see 'Secure Password Authentication' in results |
