What to do if you cannot create an app password in Microsoft 365

Some non-browser applications and services for Microsoft 365 use app passwords as an authentication method when multi-factor authentication (MFA) is enabled. The problem is that after enabling MFA for the organization, some or even all users may not be able to create and use app passwords.

What are app passwords?

App passwords are created for each MFA-enabled account to allow signing in to non-browser applications (in which case you are unable to use additional security verification methods, such as providing a code sent via a text message or approving a notification through the Microsoft Authenticator app). Those passwords don’t expire, and you can use them in different programs at the same time. However, from the security perspective, the best practice is to use one password per app, especially since each user can create up to 40 app passwords. This way, if any of those passwords gets compromised, you can delete it and continue using the remaining ones.

Microsoft security policies prevent creating app passwords in Microsoft 365

There are two most common reasons why a certain user might not be able to create or use an app password. The first is that users aren’t allowed to do so, the second – the specific user doesn’t have MFA enabled in the legacy MFA portal. See how to fix each of those issues below.

Allow users to create app passwords

1. Open the Microsoft 365 admin center and go to Users > Active users. Click the Multi-factor authentication button while no users are selected. This will let you access MFA settings. You need to be in the Authentication Administrator role (or the Global Administrator one) to access this resource.

2. (Optional) If you see the following screen, click Legacy per-user MFA to proceed.

3. On the service settings tab, choose Allow users to create app passwords to sign in to non-browser apps and save changes.

If this option is already enabled, but your users still cannot create app passwords, try the solution below.

Enable and enforce MFA for a chosen user

Users who don’t have MFA enabled will not be able to use app passwords. To allow those users to create and use app passwords, you must first turn MFA on and then enforce MFA for them, as shown below.

1. In the MFA portal you accessed in the previous section, you can check which users have MFA turned on. If the affected user cannot create app passwords, enable MFA for them by selecting the user and choosing Enable. Confirm your choice in the popup that opens.

2. Next, select the same user again and enforce MFA for them by clicking Enforce. Again, confirm your choice by clicking enforce multi-factor auth in the popup that shows up.

3. Changes applied in the MFA portal can take a while to propagate. It may be also necessary for the affected user to sign out and sign in to their Microsoft 365 account. To make it quicker, you can go to the Active users page again and force sign-out the user:

Now, the app password should appear for the user as one of the available authentication methods on the Security info page (link).

See also:

• How to create and manage Microsoft 365 security groups
• Blocking basic authentication in Office 365 (Microsoft 365)