---
title: About Authentication Types
slug: neurons-for-itsm/admin-user-help/enu/latest/about-authentication-types
createdAt: 2026-07-14T19:16:50.966Z
---
***Role**: Administrator.*
***Minimum Version**: *Ivanti Neurons for ITSM* 2023.4.*
The following table lists the supported authentication types for each protocol, based on the email component type (Basic or Advanced) selected in the **Email Configuration** workspace. For more information about email component types, refer to [Configuring the Outgoing and Incoming Email Servers](docId:7fGorhTnkWyMDm4n94geG).
| Protocol | Basic (Default) | Advanced |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| Exchange Web Services | Plain
Password is not required for Exchange Web Services users. The login is based on client credentials (OAuth). | AuthLogin |
| Google Service Account | AuthLogin | - |
| IMAP4 | AuthLogin
CramMD5
NTML
Plain | AuthLogin
CramMD5
NTML
Plain
None
Regular
DigestMD5
Msn
GssAPI
Auto |
| Microsoft Graph | AuthLogin
Password is not required for Microsoft Graph users. The login is based on client credentials (OAuth). | - |
| POP3 | APOP
AuthLogin
CramMD5
NTML
Plain | DigestMD5
GssAPI
Msn
CramMD5
AuthLogin
APOP
Plain
NTLM
Regular
Auto
None |
:::hint{type="info"}
The **AuthLogin** option is necessary to configure the Authentication for **OAuth**.
:::
The following table describes the Simple Authentication and Security Layer (SASL) authentication types:
| Authentication Type | Description |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None | No authentication.
Sometimes used with SMTP when the server allows relay for anonymous senders. |
| Regular | Standard authentication.
Passwords are transmitted as clear text. Not supported by SMTP servers. |
| APOP | Secure APOP authentication.
Supported by many POP3 servers but cannot be used with other servers like SMTP because APOP is POP3-specific. Disabled when FIPS mode is enabled. |
| AuthLogin | SASL LOGIN authentication.
Not secure but widely supported. Passwords are transmitted as Base64 strings.
Note for IMAP users: This is the **AUTHENTICATE LOGIN** command, not the **LOGIN** command (which corresponds to the **Regular** authentication type). |
| Plain | SASL PLAIN authentication.
Not secure but widely supported. Passwords are transmitted as Base64 strings. |
| CramMD5 | Secure SASL CRAM-MD5 authentication.
Might not be supported by particular server implementations. Disabled when FIPS mode is enabled. |
| DigestMD5 | Secure SASL DIGEST-MD5 authentication.
Might not be supported by particular server implementations. Disabled when FIPS mode is enabled. |
| NTLM | Secure SASL NTLM authentication. Also known as Secure Password Authentication (SPA).
In a Microsoft Windows domain environment such as Active Directory, you can also use NTLM to authenticate the current Microsoft Windows user. In this case, you should pass a null reference (or "Nothing" in Visual Basic) for the **accountName** and **password** values.
Might not be supported by particular server implementations. |
| Msn | Secure SASL MSN authentication. Equivalent to NTLM.
Not widely supported. |
| GssAPI | Secure SASL GSSAPI authentication (through Kerberos or NTLM).
Like SASL NTLM, supports Integrated Windows Authentication mode. The internal implementation (Kerberos or NTLM) is selected depending on if the value of the **targetName** field of the **Login** method is an empty string (or for SMTP, the **TargetName** field). An empty string denotes NTLM, and all other values (including a null reference) denote Kerberos.
The underlying implementation downgrades to NTLM from Kerberos if the **targetName** field is not empty but not valid (denotes non-existent SPN). |
| Auto | Tells the email service to automatically select the best supported authentication method and downgrade to insecure methods if the server does not support secure methods. |