What blocking external access means and when you need it

Blocking external access in Outlook 365 means preventing people outside your organization from connecting to your mailbox — whether through Outlook desktop apps, mobile apps, web browsers, or third-party email clients. When you turn this on, only devices and locations you explicitly allow can read your email or send messages on your behalf.

You might need this if your organization requires it for security compliance, if you've had unauthorized access to your account, or if you want to limit which devices can sync your email. Microsoft calls this feature Basic Authentication blocking and Modern Authentication restrictions, depending on which protocol you're controlling.

The actual steps depend on whether you're an administrator setting rules for your whole organization, or a single user protecting your own account. Both routes exist in Outlook 365, but they control different things.

Key Takeaways

  • Administrators block external access through the Exchange admin center by disabling Basic Authentication or creating conditional access policies in Azure AD.
  • Individual users can sign out of all other sessions and set up app passwords to limit which devices can connect, but cannot fully block external access on their own.
  • Blocking external access prevents Outlook desktop apps, mobile apps, and third-party email clients from connecting unless you create exceptions.
  • If you block external access and then need to use Outlook on a new device, you will need administrator help to restore access or create an exception.
  • Modern Authentication (the newer method) is more secure than Basic Authentication and allows for more granular control over which devices and locations can connect.

How administrators block external access organization-wide

If you manage Outlook 365 for your organization, you have two main tools: disabling Basic Authentication at the organization level, or setting up Conditional Access policies that block specific locations or device types.

To disable Basic Authentication, go to the Exchange admin center (admin.exchange.microsoft.com), select Settings in the left menu, then Outlook on the web. Under Modern Authentication, toggle off the protocols you want to block — typically IMAP, POP3, and SMTP AUTH. This prevents any app or device using the older authentication method from connecting, even if the password is correct. Users will need to use Modern Authentication instead, which requires either Outlook 2016 or newer, or a mobile app that supports it.

For more control, use Conditional Access policies in Azure AD (now called Entra ID). Go to azure.microsoft.com, sign in with your admin account, navigate to Protection > Conditional Access, and create a new policy. You can block access from specific countries, require multi-factor authentication before connecting from unknown devices, or restrict access to managed devices only. This approach is more flexible because it lets some external access through if the device or location meets your security standards.

How individual users restrict their own account access

If you're not an administrator, you cannot completely block external access to your account — that requires admin-level permissions. However, you can limit which devices can connect and sign out of sessions you don't recognize.

Sign into Outlook.com or your organization's Outlook web app, select your profile picture in the top right, then choose View account. Go to Security and select Recent activity or Session activity (the exact name varies by organization). You'll see a list of devices and locations that have accessed your account. Select any session you don't recognize and choose Sign out. This immediately ends that connection, but it does not prevent the same device from logging back in if someone has your password.

To add a layer of protection, turn on two-step verification in the same Security section. This requires a second form of proof (usually a code sent to your phone) before anyone can sign in from a new device. It does not block external access, but it makes unauthorized access much harder.

Using app passwords to control which devices connect

If your organization uses Modern Authentication and requires two-step verification, you can create app passwords — special 16-character passwords that work only with specific apps or devices. This lets you allow Outlook on your home computer while blocking it everywhere else.

Go to your account security page (myaccount.microsoft.com for personal accounts, or your organization's equivalent), select Security info, and look for App passwords. Generate a new password and give it a name like "Home Outlook" or "Work Phone". Use that password only in the app or device you want to allow. Do not share it, and delete it if you stop using that device.

App passwords work because they bypass the normal login process — they're tied to a specific app and device combination, not to your main password. If someone steals your main password but doesn't have the app password, they still cannot access Outlook on devices where you haven't created one.

What happens when external access is blocked

Once external access is blocked — whether by your administrator or through your own restrictions — here's what stops working: Outlook desktop applications (all versions), Outlook mobile apps, Gmail's ability to read your Outlook mailbox, and any third-party email client like Thunderbird or Apple Mail. Web access through Outlook.com or your organization's web portal usually still works, because that's considered internal access.

If you try to open Outlook on a blocked device, you'll see an error message like "Your organization's policies do not allow you to use this app" or "Authentication failed." The message usually does not explain why, so you'll need to contact your IT department to find out whether the block is organization-wide, device-specific, or location-specific.

If you need to use Outlook on a new device after external access is blocked, you have two options: ask your administrator to add an exception for that device, or ask them to temporarily re-enable external access while you set up the new device. Neither option is instant — it typically takes a few hours to a few days depending on your organization's processes.

The difference between Basic Authentication and Modern Authentication

Basic Authentication is the older method where you enter your username and password, and the app stores them. It's less secure because the password is stored on the device and sent with every request. Modern Authentication uses tokens instead — you sign in once, and the app receives a temporary token that expires after a set time.

Blocking Basic Authentication is the most common way to prevent external access, because it affects older apps and devices that cannot use the newer method. If your organization blocks Basic Authentication, Outlook 2013 and older will stop working, as will many mobile apps and third-party clients. Outlook 2016 and newer, plus current versions of the Outlook mobile app, use Modern Authentication and will continue to work.

If you see a message about "legacy authentication" being blocked, that's Basic Authentication. You'll need to either upgrade your app or ask your administrator to create an exception for your device.

Troubleshooting when you cannot connect after blocking is turned on

If you suddenly cannot access Outlook and suspect external access blocking is the cause, first check whether you're using an old version of Outlook. Go to File > Office Account (or Help > About) and look at the version number. If it's older than 2016, upgrade to the latest version — that usually solves the problem because newer versions support Modern Authentication.

If you're using a current version and still cannot connect, check your organization's IT help page or contact your IT department directly. Ask them whether external access blocking is turned on, whether your device is on an exception list, and whether you need to set up two-step verification or an app password. Do not try to work around the block by changing your password or using a VPN — that usually makes things worse and may trigger security alerts.

Frequently Asked Questions

Can I block external access to just my email, or does it have to be organization-wide?

Administrators can do both. Organization-wide blocking happens in the Exchange admin center and affects everyone. Individual blocking (signing out of sessions, using app passwords) only affects your own account, but you cannot completely prevent external access — you can only limit which devices can connect. Full blocking of a single user's account requires administrator action.

If I block external access, can I still use Outlook on my phone?

It depends on how the block is set up. If your administrator blocks only Basic Authentication, the Outlook mobile app will still work because it uses Modern Authentication. If they block all external access or restrict it to managed devices only, your phone will be blocked unless it's enrolled in your organization's device management program or added to an exception list.

What's the difference between blocking external access and requiring multi-factor authentication?

Blocking external access prevents certain devices or locations from connecting at all. Multi-factor authentication allows them to connect, but only after you prove your identity a second way (like entering a code from your phone). Blocking is stricter; multi-factor authentication is more flexible because it still allows access if you can verify yourself.

Will blocking external access affect my ability to use Outlook on the web?

Usually no. Outlook on the web (the browser version) is typically considered internal access and continues to work even when external access is blocked. However, some organizations block web access too, so check with your IT department if you're unsure.

How long does it take for external access blocking to take effect?

If your administrator disables Basic Authentication or creates a Conditional Access policy, the change usually takes effect within 15 minutes to an hour. If you sign out of a specific session, that happens immediately. If you create an app password, it's available right away, but it may take a few minutes for the system to recognize it on your device.