BAD User is authenticated but not connected: User does not have access to the mailbox

Microsoft 365IMAPPOP

The error usually looks like this:

A1 BAD User is authenticated but not connected.

What it means

The OAuth sign-in succeeded, but the signed-in identity does not have access to the mailbox you asked for.

Common causes

  • Your app uses app-only access (client credentials) and the service principal has not been given permission to the mailbox.
  • The username sent with the token is not the mailbox the token grants access to.

How to fix it

  1. For app-only access, register the app’s service principal in Exchange Online (New-ServicePrincipal) and grant it FullAccess to the mailbox (Add-MailboxPermission).
  2. Check that the username sent in the XOAUTH2 string matches the mailbox address.

See also our guide: Client credentials grant.

Tools to help diagnose it

OAuth token decoder and XOAUTH2 builder

Decode a Microsoft or Google access token, check its scopes, and build or decode XOAUTH2 strings

Tenant ID finder

Find your Microsoft 365 / Entra / Azure / Office 365 tenant ID from a domain name

A free tool provided by Auth-Email

Auth-Email makes your Gmail, Outlook, or other OAuth 2.0 email account available to any IMAP, POP3, or SMTP email client — no app passwords or special configuration needed.

Read the docsTry Auth-Email →

← Look up another email error