This little tutorial in the form of a testimony after days of fruitless research.
I hope that this page will be useful to others.
I have users on Exchange OnLine 365 who want to use Thunderbird. And so they need IMAP access.
For the past few months, Microsoft has been making MFA identification recommended by going so far as to put this in the default configuration.
So if you enable MFA, your users will not be able to use IMAP, do not look, it is not compatible.
To do so, it is necessary either to use conditional access which requires a licence: an Azure Active Directory P1 or P2 licence: https://docs.microsoft.com/fr-fr/azure/active-directory/conditional-access/overview#license-requirements
Either disable the default security settings and sharpen the MFA individually (which is not recommended by Microsoft). I think that at least the administrative counties must be in MFA, it is really a minimum.
Here is the procedure:
Disable the default security settings:
To disable the default security settings in your directory:
- Log in to Azure Portal as security administrator, conditional access administrator or general administrator.
- Go to Azure Active Directory > Properties.
- Select Manage Default Security Settings.
- Define Enable Default Security Settings on No using the toggle button.
- Select Save.
Enable MFA for users who do not use MFA (minimum Adminsitrators)
Other information:
Note: : With Outlook, no worries with the MFA
If you set the box in Outlook automatically using autodiscover, you can have the MFA enabled because Outlook uses modern authentication and it supports the MFA.
https://docs.microsoft.com/fr-fr/office365/enterprise/hybrid-modern-auth-overview
Why is Microsoft pushing for MFA?
Read this article:
English 
French 
Spanish 
Chinese 
German