I have been using gnus for my various email accounts for years, but now my university has moved to outlook.office365 which requires oauth2. I can see that there is an oauth2 package for emacs, but no examples on its use nor how one might combine with gnus. And while I can see some online examples of people using offlineimap oauth2 with gmail I have not seen it for MS o365. Apparently Thunderbird can use oauth2. Has anyone had success with any of the emacs email applications (but gnus preferred)? If so, can you give some suggestions please? If not, any ideas how to figure out what Thunderbird is doing so that it might be emulated in gnus. Even a simple walkthrough the oauth2 package would be helpful.

  • I would look at Davmail. Here's their FAQ concerning how to add it. See also this reddit thread. The key is to connect to davmail locally (i.e. localhost) via offline imap or mbsync, and then let davmail connect to office 365 or exchange. I've gotten this to work succesfully for mbsync for my university. – mclear Mar 21 at 2:01
  • I am having the same problem. Davmail seems like it should work. But I can't get it to open up the oauth2.0 window. See stackoverflow.com/questions/66754677/… I can confirm with the OP that Thunderbird is currently working (since a lot of people have had their setups broken recently and are viewing this thread). I'd recommend anyone having this problem uses thunderbird in the interim. Because outlook365 is blegh soyface – lucky cat Mar 22 at 22:27
  • have you tried localhost:1080 while running davmail? See also this thread: github.com/mguessan/davmail/issues/63 – mclear Mar 23 at 1:57

Please see the gnus-o365-oauth2 module i just posted. I'll quote the intro from the comments below.

It works, but far from perfectly, oauth2/plstore/gnupg stores the access tokens retrieved in an encrypted file but either the setting to have plstore cache the passphrase for the encrypted file doesn't work or gnupg keeps inventing new keys to store the access tokens under or something along those lines, whatever the cause the result is that oauth2/plstore/gnupg causes recurring popups to inquire about a passphrase a few times per hour. Answer something you can type quickly and tick the box to save it for the least possible inconvenience.

Here's the intro to the module:


oauth2 tweaked to accept an optional function argument read-authorization-string for the functions that invoke browse-url, see this repo for now.


  1. Obtain Office 365 tenant id:

See: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols#endpoints

  1. Set tenant id:

    (setq gnus-o365-oauth2-tenant-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")
  2. Obtain client identifier:

The client-secret may very well not be called for. Ask your Exchange administrator or someone else that has access to the "App registrations experience in the Azure portal", see: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#request-an-authorization-code https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols#app-registration https://aka.ms/appregistrations

  1. Set client identifier(s):

    (setq gnus-o365-oauth2-client-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")
    (setq gnus-o365-oauth2-client-secret "xxxx")
  2. Set custom authenticator:

    (require 'oauth2)
    (require 'gnus-o365-oauth2) ; must be loaded *after* (setq gnus-o365-oauth2-*)
    (advice-add 'nnimap-login :before-until #'gnus-o365-oauth2-imap-authenticator)
  3. Configure plstore (optional):

oauth2 uses plstore to save access tokens in ~/emacs.d/oauth2.plstore, which is gpg-encrypted. This allows the gpg passphrase to be cached during the Emacs session:

   (setq plstore-cache-passphrase-for-symmetric-encryption t)

I have had success with gnus with the following configuration.

(setq message-send-mail-function 'smtpmail-send-it
    smtpmail-default-smtp-server "smtp.office365.com"
    smtpmail-smtp-server "smtp.office365.com"
    user-mail-address "<your mail address>"
    smtpmail-smtp-service 587
    smtpmail-stream-type 'starttls

(setq smtpmail-stream-type 'tls) does not work.

I was led to try this configuration based on this info.

  • How is that related to the requirement of OAuth2? – wasamasa Oct 15 '20 at 21:22
  • I have no idea but I know that my mails go through with this settings. I don't know if my account requires OAuth2 or not. – DJJ Oct 15 '20 at 21:51
  • Thanks for the suggestion, but it is the oauth authentication that is giving me problems. I know thunderbird is able to pass the test. I think we should be able to do it with: auth-source-xoauth2 if one could get a client id and client secret. Would be nice to have a working example. – brittAnderson Oct 17 '20 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.