June Offer Every MAX plan gets a fully custom-built system Free custom system worth $1,500-$10,000 · worth $1,500-$10,000

Microsoft 365 / Exchange Online SMTP Setup (2026): The Th...

Microsoft 365 / Exchange Online SMTP Setup (2026): The Three Gates

Author:
Matt Kielbasa
Matt Kielbasa
|10 min read|
Microsoft 365 / Exchange Online SMTP Setup (2026): The Three Gates
Matt KielbasaMatt Kielbasa••10 min read

Microsoft disables SMTP AUTH tenant-wide by default since October 2022, and again for any new tenant since 2023. To send through smtp.office365.com, an admin must explicitly enable it at three levels: Security Defaults, tenant, and per-mailbox. Skipping any one returns the same generic 535 5.7.139 Authentication unsuccessful error.

Microsoft 365 SMTP values
SMTP host
smtp.office365.com
Port
587 (STARTTLS)
Username
full Microsoft 365 email (UPN, not alias)
Password
App Password - Modern Auth blocks the regular password

The three gates SMTP AUTH must pass

Each gate has its own enable path, its own PowerShell equivalent, and its own failure mode. Go through them in order.

  1. Security Defaults - tenant-wide setting that, when on, blocks SMTP AUTH no matter what else you configure.
  2. Tenant-wide SmtpClientAuthenticationDisabled - Exchange Online setting that controls SMTP AUTH for the entire tenant.
  3. Per-mailbox SmtpClientAuthenticationDisabled - overrides the tenant setting on a specific mailbox.

Gate 1 - Confirm Security Defaults are OFF (or you have an exception)

If "Security defaults" is enabled in your tenant (the default on new tenants since 2019), SMTP AUTH is blocked organization-wide regardless of any other setting.

  1. Sign in to entra.microsoft.com as a tenant admin.
  2. Left rail, Identity → Overview.
  3. Click Properties.
  4. Click Manage Security defaults.
  5. If "Security defaults" is Enabled, you have two options: turn it off (and replace it with Conditional Access policies that allow SMTP AUTH for the sender), or accept that SMTP AUTH cannot be used in this tenant.

Gate 2 - Enable SMTP AUTH at the tenant level

Two paths.

Exchange admin center (EAC):

  1. Sign in to admin.exchange.microsoft.com.
  2. Settings → Mail Flow.
  3. Find the toggle "Turn off SMTP AUTH protocol for your organization". Set it to OFF.

PowerShell (Exchange Online module):

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Confirm with:

Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

Expected: SmtpClientAuthenticationDisabled : False

Gate 3 - Enable SMTP AUTH on the specific mailbox

Even with tenant-wide AUTH on, the per-mailbox setting can disable it.

Admin center path:

  1. Open admin.microsoft.com.
  2. Users → Active users, click the sending mailbox.
  3. Flyout: Mail tab.
  4. In the Email apps section, click Manage email apps.
  5. Check the Authenticated SMTP box.
  6. Save changes.

PowerShell equivalent:

Set-CASMailbox -Identity sender@yourtenant.com -SmtpClientAuthenticationDisabled $false

Confirm:

Get-CASMailbox -Identity sender@yourtenant.com | Format-List SmtpClientAuthenticationDisabled

Generate the App Password

  1. The mailbox user signs in to portal.office.com.
  2. Top-right profile avatar → View account.
  3. Left rail, Security info.
  4. Click Add sign-in method, choose App password, name it "Inflowave".
  5. Microsoft shows the password once. Copy and paste into Inflowave immediately.

If the App Password option does not appear: The user does not have MFA enabled, OR the tenant authentication policy disables App Passwords via Conditional Access. Ask your Microsoft 365 admin.

Connect to Inflowave

  1. Inflowave → Settings → Email → Add sending domain → Custom SMTP.
  2. Host: smtp.office365.com, Port: 587.
  3. Username: the User Principal Name (UPN), e.g. sender@yourtenant.onmicrosoft.com. Do NOT use an alias.
  4. Password: the App Password.
  5. Save, then send a test.

UPN, not alias: The SMTP username must be the UPN. Sending as an alias returns 550 5.7.60 SMTP; Client does not have permissions to send as this sender. To send as an alias, configure it as a primary SMTP address or set up Send As permissions in Exchange.

Troubleshooting

"535 5.7.139 Authentication unsuccessful"

One of the three gates is closed. Re-verify all three in order. Most common cause is Gate 3 (per-mailbox SMTP AUTH not enabled).

"530 5.5.1 Authentication Required"

You connected without authentication. Confirm credentials are populated in Inflowave.

"550 5.7.60 Client does not have permissions to send as this sender"

Username (UPN) and From address don't match. Send as the same UPN you authenticated with, or set up Send As permissions.

"554 5.4.1 Recipient address rejected: Access denied"

You exceeded a recipient or rate cap. See Exchange Online sending limits below.

Exchange Online sending limits

  • 10,000 recipients per user per 24h on standard Exchange Online plans.
  • 500 recipients per single message in the To, Cc, Bcc fields combined.
  • 30 messages per minute via SMTP AUTH.
  • Exceeding any of these returns 554 5.4.1 and outbound is throttled or paused.
  • High Volume Email (HVE) plan available for tenants needing higher volume - Microsoft's recommended path for transactional sending replacing legacy SMTP AUTH.

Official sources

2026 OPERATOR REPORT

The Agency Profit Playbook Is In

How do 80+ agency operators rate their own pricing, retention, and margin? The Agency Profit Playbook has the benchmarks.

You can unsubscribe in one click. Privacy Policy

The Agency Profit Playbook 2026 cover

Ready to send from Microsoft 365?

Walk through the three gates in order. Each one is the most common stuck-point we see.

Start Free Trial View Pricing