That begs the question, if the application can authenticate through just a username and password, and multi-factor authentication is enforced in the domain, then how does that satisfy the requirement for multi-factor authentication? This question is perhaps why so many users misunderstand app passwords or have perhaps never thought to create an app password in the first place.

There is a bit more to it than that, but an app password provides a way for a non browser application connecting to Microsoft 365 to authenticate with a username and a single password without using a second factor. The core idea of how app passwords came about was the need for Microsoft 365 application designers to provide an authentication mode for a non-interactive login in a Microsoft 365 environment with multi-factor authentication (MFA) policies enforced. In an environment of increasing security restrictions, I have noticed in my role as a Microsoft 365 administrator a misunderstanding among users regarding application (or app) passwords. Summary: Application (or App) Passwords Provide a Way for Applications to Authenticate in Microsoft 365 when MFA Policies are Enforced

Enable app passwords office 365