CRM and other apps

Turn on SMTP sign-in for one mailbox, and what changes in December 2026

How to switch on Authenticated SMTP (SMTP AUTH) for a single Microsoft 365 mailbox that an app signs in to, the settings the app needs, and the change Microsoft has announced for Basic authentication at the end of December 2026.

Last checked against Footer365 on 23 October 2026

Some apps send mail by signing in to a Microsoft 365 mailbox over SMTP, at smtp.office365.com. Microsoft calls this SMTP client submission, or SMTP AUTH. The message leaves from your own Exchange Online, so Footer365 signs it like any other mail from that mailbox. Microsoft says SMTP AUTH is disabled for organisations created after January 2020, and it can be turned on for a single mailbox.

An app that can connect with a Microsoft sign-in through Microsoft Graph or OAuth is a better choice than one that stores a username and password. Choose how your CRM or app sends its mail

Turn it on for one mailbox

In the Microsoft 365 admin center:

  1. Open https://admin.microsoft.com and go to Users > Active users.
  2. Select the user, and in the flyout select Mail.
  3. In the Email apps section, select Manage email apps.
  4. Check Authenticated SMTP. Unchecked is off and checked is on.
  5. Select Save changes.

In Exchange Online PowerShell, the same setting is:

Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false

To check it, run Get-CASMailbox -Identity [email protected] | Format-List SmtpClientAuthenticationDisabled. False is on, True is off, and blank means the organisation's setting decides. Microsoft: enable or disable SMTP AUTH in Exchange Online

How the organisation setting fits in

  • Microsoft says the mailbox setting overrides the organisation's: "The mailbox setting takes precedence over the organization setting."
  • The organisation's setting is Turn off SMTP AUTH protocol for your organization on the Mail Flow settings page of the Exchange admin center, or Set-TransportConfig -SmtpClientAuthenticationDisabled $true.
  • Microsoft recommends turning SMTP AUTH off for the organisation and on only for the mailboxes that need it.
  • If security defaults is on in your organisation, SMTP AUTH is already off, and Microsoft says you must turn security defaults off to use it.

What the app needs

Microsoft's settings for the app:

Setting Value
Server smtp.office365.com, never an IP address
Port 587 (recommended) or 25
Encryption STARTTLS, with TLS 1.3 or TLS 1.2
Sign-in The mailbox's address, with Microsoft's OAuth or its password

Microsoft says an app that recommends or defaults to port 465 "doesn't support the required versions of TLS for client SMTP submission". If the app needs to send as an address other than the one it signs in with, the signed-in account needs the Send As permission on the other mailbox. Without it, Microsoft says messages come back as a non-delivery report with "5.7.60 SMTP; Client doesn't have permissions to send as this sender". Microsoft: how a device or application can send email through Microsoft 365

OAuth and shared mailboxes

SMTP AUTH supports OAuth as well as a password. For a person's sign-in the permission scope is https://outlook.office.com/SMTP.Send. For an app with no signed-in person Microsoft describes the SMTP.SendAsApp application permission, with the client credentials flow, after which an administrator registers the app's service principal in Exchange with New-ServicePrincipal and gives it access to specific mailboxes with Add-MailboxPermission. For a shared mailbox, Microsoft says the app gets the token on behalf of a person and replaces the user name in the sign-in string with the shared mailbox's address. Microsoft: authenticate an IMAP, POP or SMTP connection using OAuth

Whether a particular vendor's app signs in this way or with a password is in the guide for that app, where the vendor says.

What changes in December 2026

Microsoft's Message Center post MC786329, updated on 27 January 2026, says:

  • Until December 2026 the behaviour of SMTP AUTH Basic authentication is unchanged.
  • At the end of December 2026 Basic authentication is disabled by default for existing organisations, and administrators can still enable it.
  • Organisations created after December 2026 have it unavailable by default.
  • In the second half of 2027 Microsoft will announce the final removal date.

Microsoft message MC786329

Microsoft's own page on Basic authentication says the timeline has been updated and tells you to check the latest announcement: "As the retirement timeline has been updated, we recommend referring to the latest official announcement for current milestones and guidance". It also says: "Other options for sending authenticated mail include using alternative protocols, such as the Microsoft Graph API." Microsoft: deprecation of Basic authentication in Exchange Online

So an app that signs in to SMTP with a username and password is expected to stop working on an existing organisation at the end of December 2026, unless an administrator turns Basic authentication back on. The change is about Basic authentication. An app that signs in with OAuth is not part of it, and SMTP AUTH itself must still be turned on for its mailbox as above. Reconnect the app through its Microsoft option if the vendor offers one.

Limits

Microsoft's limits for a mailbox are 10,000 recipients a day and 30 messages a minute. Microsoft: Exchange Online limits

Sources

Read on 23 October 2026:

Still stuck?

Tell us what you were trying to do and what you saw. Include the sender, a recipient and roughly when a message was sent, and we can trace it.

Contact support Service status