How to Create an App Password

Funny business meeting with boss and skeletons
Most modern applications work with 2 Factor Authentication, but some older (or, 'legacy') applications do not support this modern sign in method. Instead, if you need to connect one of these applications to your Microsoft 365 account, you will need to use a specially generated password called an 'App Password'

What is an App Password?

An App Password is a special password that is generated for you within your Microsoft 365 account. It’s designed to be used only in applications that do not support 2 Factor Authentication, or systems that log into the account without human intervention.

IMPORTANT! You should never write down or store the App Password anywhere! This password will give access to your account without the need to use 2 Factor Authentication, and as such it is insecure. You should only use an App Password if there is no alternative, and generate it only when you need to use it. It will be displayed on the screen once only. You should periodically review you App Passwords and delete any that are no longer required.

Create an App Password

Go to View Account and then click on Security Info > Update Info

Here you will see other security items relating to your account, such as your phone number and secondary email account. Click ‘Add method’

Choose App Password from the drop down list

Give the password a name

The App Password is displayed. Copy the password to a temporary location like an open Notepad file, as it won’t be displayed again. Do not save this password permanently as it will give access to your account bypassing the 2FA requirement.

It may take a few minutes before the App Password is fully registered so you may need to wait a short time before the application or service you are using it in registers as connected.

Further reading

Passkeys Vs Passwords 2 med

Leave Passwords in the Past: Why the NCSC Is Backing Passkeys for Login Security

The UK’s National Cyber Security Centre (NCSC) has delivered a clear new message: “Leave passwords in the past – passkeys are the future.” In April 2026, the NCSC formally updated its guidance to recommend using passkeys as the default way to log in wherever services support them, instead of traditional passwords (even those paired with multi-factor authentication). This is a major shift in cyber security advice, and overturns decades of password-centric best practices.

Read More »