Microsoft 365 SMTP Settings

Microsoft 365 work and school mailboxes send mail from apps, printers and scanners through smtp.office365.com on port 587 with STARTTLS. Microsoft calls this SMTP AUTH client submission. It needs three things besides the right server name: a licensed mailbox, TLS 1.2 or later, and SMTP AUTH switched on for that mailbox. If any one is missing, sending fails even when the settings below are typed correctly.

These settings are for business mailboxes on Exchange Online. A personal Outlook.com, Hotmail or Live address uses different servers — see Outlook.com SMTP settings.

Microsoft 365 SMTP settings

Port 465 is not supported. Microsoft notes that a device or app that defaults to port 465 doesn't support the TLS versions client submission requires. Always enter the server name, not an IP address.

Before it will work

• A licensed mailbox. The account the device signs in with must be a licensed Microsoft 365 mailbox.
• SMTP AUTH enabled for that mailbox. Microsoft disables SMTP AUTH for organizations created after January 2020. An administrator can turn it on for individual mailboxes (steps below).
• TLS 1.2 or later. A device that can't negotiate TLS 1.2 can't use client submission at all. Check for a firmware update, or use SMTP relay instead.
• Security defaults off for this purpose. When security defaults are enabled in Microsoft Entra ID, SMTP AUTH is already disabled, and client submission with Basic authentication isn't compatible with them.

Turn on SMTP AUTH for one mailbox

Microsoft recommends keeping SMTP AUTH off for the organization and enabling it only for the mailboxes that still need it — for example, the account a scanner uses. An administrator can do this in either of two places.

In the Microsoft 365 admin center

1. Go to Users > Active users and select the user.
2. Select Mail, then Manage email apps.
3. Check Authenticated SMTP and select Save changes.

In Exchange Online PowerShell

Set-CASMailbox -Identity scanner@contoso.com -SmtpClientAuthenticationDisabled $false

To check the result:

Get-CASMailbox -Identity scanner@contoso.com | Format-List SmtpClientAuthenticationDisabled

False means enabled, True means disabled, and a blank value means the mailbox follows the organization-wide setting. A mailbox setting always overrides the organization setting.

One more lock can still apply: if an authentication policy blocks Basic authentication for SMTP, clients can't use SMTP AUTH with a password even after this setting is enabled.

Passwords, OAuth and Basic authentication

Microsoft recommends OAuth for client submission. Basic authentication — a username and password stored on the device — is scheduled for deprecation in Exchange Online, and Microsoft has revised that schedule since first announcing it. Check Microsoft's current deprecation timeline before relying on a password-only setup, and plan for the device to move to OAuth or to one of the options further down.

Sending from a different address

If the From address isn't the mailbox the device signs in with — a shared address like invoices@, for example — the sign-in mailbox needs Send As permission for it. Without that, the message is refused with:

5.7.60 SMTP; Client doesn't have permissions to send as this sender

When SMTP AUTH isn't the right fit

Microsoft documents two other ways for devices and applications to send through Microsoft 365. Both connect to your domain's MX endpoint — in the form contoso-com.mail.protection.outlook.com — on port 25.

Microsoft says most customers don't need direct send. SMTP relay needs an inbound connector and either a certificate or a static IP address that isn't shared outside your organization; dynamic IP addresses aren't allowed. For application mail that can't use OAuth, Microsoft points to High Volume Email for internal recipients, and Azure Communication Services Email when external recipients are involved.

If it still won't send

• Port 465 is set. Change to 587 with STARTTLS.
• Authentication is rejected. Confirm Authenticated SMTP is enabled for the mailbox, security defaults aren't blocking it, no authentication policy blocks Basic authentication for SMTP, and the mailbox is licensed.
• Error 5.7.60. The sign-in mailbox lacks Send As permission for the From address.
• TLS or connection errors on an older device. It may not support TLS 1.2. Update the firmware, or move the device to SMTP relay.
• Sending stops partway through a batch. Client submission is capped at 30 messages per minute and 10,000 recipients per day.

Not sure the domain is on Microsoft 365 at all? Enter the address in the Email Settings Finder — it reads the domain's mail records and tells you.

Incoming mail settings

To receive Microsoft 365 mail in an IMAP or POP client, use outlook.office365.com with port 993 and SSL/TLS for IMAP, or port 995 and SSL/TLS for POP. Use the full email address as the username, and leave Secure Password Authentication turned off. Accounts operated by 21Vianet in China use partner.outlook.cn for incoming mail and smtp.office365.cn for sending.