Office 365 SMTP authentication failing, even with correct account information

I've been working on this the past 3 days. Recently we add multi factor security for our users and after that an inhouse application which sent emails via SMTP authentication failed to authenticate the user. I removed the MFA from the user but it didn't help. Here's how I finally solved it with the help of this thread and this one. [SOLVED] Everything using Office 365 SMTP authentication is broken, wont authenticate? - Spiceworks

First find the reason its not authenticating. You can go into the Azure AD Admin Center-> Users->Sign Ins

FInd the user and incident where it failed. In my case the application was "Office365 Exchange Online" The reason for failure was "

Access has been blocked by Conditional Access policies. The access policy does not allow token issuance."

This is a default policy that apparently is created when Modern Authentication is turned on which is a prerequisite for MFA. To get my authentication back and keep the MFA, i had to uncheck the modern authentication, create a policy for MFA sign ins.

Uncheck modertn authentication: 365 admin center -> Settings -> org settings -> Modern authentication.

To create conditional policies: Azure AD Admin Center->Azure AD -> Security ->Conditional Access

• New Policy Select the users or groups , Grant -> Require MFA

Enable policy and Save.

This solved my specific problem.

 I was struggling with that too. Finally I found a solution which requires to change properties in Azure Active Directory (Properties > Manage Security Defaults). You have to turn off "Enable Security defaults" like at the linked screenshot from the documentation.

 

The starting point to find that solution was **Microsoft 365 Admin Center > Settings > Org settings > Services > Modern authentication.**The link to the above mentioned documentation is provided in description of Modern authentication.

 

Now I'm able to send emails by SMTP protocol with using an app password from MFA enabled account. 

Yes - Microsoft have made OAuth2 (the basis for Modern Authentication) a prerequisite for MFA. And it would be a bit pointless enabling MFA but leaving Basic Authentication enabled - a bit like double-locking the front door but leaving an adjacent window wide open!

And to Mark0756's comment "MS Office tells me to pay my web host to fix", could he elaborate exactly what it says pls?

In the documentaton it says "If your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings outlined in this article. For more information, see Disable Basic authentication in Exchange Online."

Since Microsoft Security Defaults disables basic authentication does this solution still works?

Kind Regards,

@all i think this ist the solution:

I had the same Problems, old offic365 accounts work, new accounts did not work. After searching for 5 hours i get a solution:

In the old accounts SmtpClientAuthenticationDisabled is false by default on online Exchange, in the new accounts it is True by default.

I had to set it to false by exchange online powershell and also hat do go to e-mail-apps and set the hook to authenticated smtp

after that it worked. Here you can read what is to do by exchange powershell:

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission

Steps in Powershell:

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

Import-PSSession $Session -DisableNameChecking

Take a look if it is True: Get-TransportConfig  (if there is True set to false)

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Take a look again if it works: Get-TransportConfig

Remove-PSSession $Session

In Admin Center --> acitve Users --> click the user --> email-apps --> click the hook --> authenticated smtp

With this combination it worked for me. Hope this can help you all

Hello Adam,

Do you have any related information to share with us?

Thanks,

Anna