In an environment of increasing security restrictions, I have noticed in my role as a Microsoft 365 administrator a misunderstanding among users regarding application (or app) passwords. The core idea of how app passwords came about was the need for Microsoft 365 application designers to provide an authentication mode for a non-interactive login in a Microsoft 365 environment with multi-factor authentication (MFA) policies enforced. There is a bit more to it than that, but an app password provides a way for an application connecting to Microsoft 365 to authenticate with a username and a single password without using a second factor. That begs the question, if the application can authenticate through just a username and password, and multi-factor authentication is enforced in the domain, then how does that satisfy the requirement for multi-factor authentication? This question is perhaps why so many users misunderstand app passwords or have perhaps never thought to create an app password in the first place. We will try to clear up some of the confusion in our post today.