What Most People Miss About Changing Outlook Authentication Method

By Rachel Torres
You can’t manually switch Outlook’s authentication method after setup — not in the way most people assume. But that doesn’t mean it’s impossible; it just means the real control lives elsewhere: in your account configuration, Windows credential manager, or your organization’s Azure AD policies.

The Short Version

Method Pros Cons Works in Outlook Web?
Re-add account with modern auth Uses OAuth 2.0, supports MFA, no password stored locally Requires admin consent if app registration is restricted N/A (Web uses modern auth by default)
Clear Windows Credentials Fast fix for cached Basic Auth credentials Doesn’t change underlying protocol — just forces re-prompt No effect on Outlook Web
Registry edit (Outlook 2016/2019) Forces modern auth even when autodiscover misbehaves Unsupported by Microsoft; breaks with some security updates No effect
Exchange Admin Center toggle Global control over Basic Auth enable/disable per protocol Requires Global or Exchange Admin role; affects all users Yes — governs backend enforcement

Method 1: Re-add your account with modern authentication

This is the cleanest, safest, and most reliable method — especially if you’re using Outlook for Microsoft 365 or Outlook 2019+. Modern authentication (OAuth 2.0) isn’t something you ‘select’ in a dropdown. It activates automatically when Outlook detects your account is backed by Azure AD and your tenant allows it. But here’s what trips people up: Outlook caches your original sign-in method. If you first added your account using Basic Auth (username + password), Outlook will keep trying that — even after your org disables Basic Auth. So you have to remove and re-add. Here’s how:
  • Go to File > Account Settings > Account Settings…
  • Select your account → click Remove
  • Click New… → choose Microsoft 365 or Exchange (not POP/IMAP)
  • Enter your email → click Connect. You’ll get redirected to the Azure AD sign-in page.
If you see a browser window asking for permissions (“Outlook wants to access your mailbox”), that’s modern auth working. If you instead get a simple username/password prompt *inside Outlook*, Basic Auth is still active — either because your tenant blocks modern auth, or because your Outlook version is too old. Outlook 2013 (without KB2965295) and Outlook 2016 RTM (before version 16.0.4266) don’t support modern auth at all. You’ll need to update. And yes — this wipes your local OST file. You’ll redownload mail. Plan for 10–30 minutes depending on mailbox size. (I’ve seen people skip this step and wonder why their calendar stays empty for hours.)

Method 2: Clear Windows Credential Manager entries

Sometimes Outlook isn’t using outdated settings — it’s using outdated *credentials*. Especially common after a password reset or MFA rollout. Windows stores Basic Auth tokens under “Generic Credentials” in Credential Manager — and Outlook reuses them silently, even when modern auth is available. To clear them:
  • Open Control Panel > User Accounts > Credential Manager
  • Click Windows Credentials
  • Expand Generic Credentials
  • Delete any entries starting with MicrosoftOffice16:https://outlook.office365.com/ or MicrosoftOffice15:
Then restart Outlook. You’ll get a fresh sign-in prompt — and this time, it should go to the Azure AD page. Pro tip: Use Ctrl+Shift+Alt+R while Outlook is open to force a full reconnect (this shortcut triggers autodiscover refresh and credential renegotiation). It’s undocumented but works reliably in Outlook 365 and 2021. This method won’t work if Basic Auth is still enabled server-side — but it’s often the fastest fix when your org has already disabled it and Outlook just hasn’t gotten the memo.

Method 3: Registry override (for stubborn Outlook 2016/2019 installs)

This one’s a last resort — and honestly, I only reach for it when a client is stuck on an older image (like Windows 7 + Outlook 2016) and can’t upgrade. Outlook uses registry keys to decide whether to attempt modern auth. By default, it relies on autodiscover responses — but those can be delayed, cached, or misconfigured. Add this DWORD value: 
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover\UseModernAuth = 1
(For Outlook 2019, use 16.0; for Outlook 2021 or Microsoft 365 Apps, use 16.0 or 17.0 — same path.) Restart Outlook. If modern auth is available for your account, it’ll now try it first. But here’s the counterintuitive part: This key *only forces the client to attempt* modern auth. It doesn’t bypass server policy. If your Exchange Online tenant has Basic Auth disabled for IMAP/SMTP/EWS, this key won’t help — because those protocols simply won’t negotiate OAuth. Also: This setting gets ignored if Outlook detects a hybrid Exchange setup with legacy CAS servers. (I spent two days troubleshooting this before checking the autodiscover XML response — lesson learned.)

Which Should You Choose?

Your Situation Best Method Why
You’re on Outlook 365 or 2021, and just got an MFA prompt failure Clear Windows Credentials Cached Basic token is blocking the OAuth flow — clearing it restores the redirect
Your company disabled Basic Auth last week, but Outlook still shows 'Connecting…' forever Re-add account Outlook won’t renegotiate auth type unless forced via full account removal
You manage 200+ users on Outlook 2016, and autodiscover keeps falling back to Basic Registry override + Group Policy Bulk-deploy the UseModernAuth=1 key, then push updated autodiscover DNS records
You're using Outlook Web App and getting 'Authentication failed' Check Exchange Admin Center OWA always uses modern auth — so failure points to conditional access or blocked legacy protocols
You see 'The connection to Microsoft Exchange is unavailable' after password change Clear Windows Credentials + Ctrl+Shift+Alt+R Old token persists in cache; shortcut forces immediate renegotiation
One final note about Exchange server settings: Modern authentication requires more than just client-side changes. Your Exchange Online tenant must have modern auth enabled *and* Basic Auth disabled per protocol (EWS, POP, IMAP, SMTP). You can check this in the Exchange Admin Center under Mail flow > Remote domains > [your domain] > Authentication, or run Get-OrganizationConfig | fl OAuth2ClientProfileEnabled in PowerShell. If Basic Auth is still enabled for EWS, Outlook desktop may fall back to it — even with UseModernAuth=1 set. That’s why the 're-add' method is safest: it bypasses the fallback logic entirely.
Rachel Torres

Rachel Torres

Rachel coaches teams on email management and digital communication best practices. She has trained over 5