Sending Email via Office 365 SMTP Using OAuth (XOAUTH2)

This article explains how to configure a backend or service to send mail through smtp.office365.com (port 587) using OAuth (XOAUTH2) instead of basic authentication.

Prerequisites

You’ll need:

• Tenant admin rights in Microsoft 365 (Entra + Exchange admin)
• Exchange Online PowerShell module on an admin workstation
• A server to run PowerShell commands
• The sender mailbox you will send as (for example, [e-mail])

Step 1: Register an App in Microsoft Entra ID

1. Navigate to Entra admin center > App registrations > New registration
   • Name: SMTP OAuth App ConnecttoAD
   • Supported account types: Single tenant (recommended)
   • Redirect URI: not required for client credentials
2. Open the app > Certificates & secrets > New client secret
   • Copy the Secret Value now; you won’t see it again.
3. Add API permissions:
   • Go to APIs my organization uses
   • Search for Office 365 Exchange Online
   • Choose Application permissions
   • Add SMTP.SendAsApp
   • Click Grant admin consent for the tenant

4. Capture the following values for your app:

   • Tenant (Directory) ID
   • Application (Client) ID
   • Client secret (value)

   Authority:

   https://login.microsoftonline.com/<TENANT_ID>/v2.0
   

   Scope:

   https://outlook.office365.com/.default
   

Step 2: Register the Service Principal in Exchange and Grant Mailbox Access

This links your Entra app to Exchange Online and gives it rights to the sender mailbox.

Connect to Exchange Online PowerShell:

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline

Find your app’s IDs: Navigate to Entra > Enterprise applications > (your app). You’ll need both:

• The App ID
• The Enterprise App Object ID (this Object ID is not the App Registration object ID)

Register the service principal in Exchange:

New-ServicePrincipal -AppId <APPLICATION_ID> -ObjectId <ENTERPRISE_APP_OBJECT_ID> -DisplayName "SMTP OAuth App"

Grant mailbox access to the service principal:

$exoSp = Get-ServicePrincipal -Identity "SMTP OAuth App"

# Allow the app to access the sender mailbox
Add-MailboxPermission -Identity "[e-mail]" -User $exoSp.Identity -AccessRights FullAccess

# Allow ConnecttoAD to send-as the mailbox identity
Add-RecipientPermission -Identity "[e-mail]" -Trustee $exoSp.Identity -AccessRights SendAs

At least FullAccess to the sender mailbox is required. Tip: If authentication succeeds but sending fails with “not permitted to send as this user,” add SendAs permission.

Step 3: Ensure SMTP AUTH Is Allowed (Tenant and Mailbox)

Tenant level:

# Check org-wide SMTP AUTH status
Get-TransportConfig | fl SmtpClientAuthenticationDisabled

# If disabled, enable it
Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Mailbox level:

# Enable SMTP AUTH on the sender mailbox (overrides org setting)
Set-CASMailbox -Identity "[e-mail]" -SmtpClientAuthenticationDisabled $false

Step 4: Configure Your Service or App

• SMTP host: smtp.office365.com
• Port: 587
• Secure Socket: StartTLS
• XOAUTH2 username (Sender Address): for example [e-mail]
• Auth Type: OAuth2
• Authority: https://login.microsoftonline.com/<TENANT_ID>/v2.0
• Client ID and Client Secret: Client credentials (app’s client ID/secret) to obtain an access token
• Scope for token request: https://outlook.office365.com/.default

You should now be able to use OAuth to send your mail. If you experience any issues, please refer to the troubleshooting section below.

Troubleshooting Common Issues

• 535 5.7.3 Authentication unsuccessful – SMTP AUTH is disabled at the org or the mailbox. Please review Step 3.
• Wrong scope – Must be https://outlook.office365.com/.default.
• Service principal not registered in Exchange – Or wrong ObjectId (must be from Enterprise applications).
• Missing FullAccess or SendAs – Verify permissions on the mailbox.
• App gets token but send fails with “not allowed to send as” – Add RecipientPermission SendAs for the service principal, or send from a mailbox the app has rights on.
• AADSTS700016 / invalid_client – Check client ID, secret, and tenant in the Authority URL.
• Security defaults block – If Security Defaults are enabled, SMTP AUTH may be off by default. Adjust organization and mailbox settings as needed.