Office 365 SMTP authentication failing, even with correct account information

@all i think this ist the solution:

I had the same Problems, old offic365 accounts work, new accounts did not work. After searching for 5 hours i get a solution:

In the old accounts SmtpClientAuthenticationDisabled is false by default on online Exchange, in the new accounts it is True by default.

I had to set it to false by exchange online powershell and also hat do go to e-mail-apps and set the hook to authenticated smtp

after that it worked. Here you can read what is to do by exchange powershell:

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission

Steps in Powershell:

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

Import-PSSession $Session -DisableNameChecking

Take a look if it is True: Get-TransportConfig  (if there is True set to false)

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Take a look again if it works: Get-TransportConfig

Remove-PSSession $Session

In Admin Center --> acitve Users --> click the user --> email-apps --> click the hook --> authenticated smtp

With this combination it worked for me. Hope this can help you all

Thanks for digging into this.

It is frustrating as on the application development side, to get announcements like these https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-oauth-2-0-support-for-imap-and-smtp-auth-protocols-in/ba-p/1330432

And then to move forward with implementation and getting customers through any friction with admin consent and then to discover that old accounts will respect the OAuth SMTP scope grant, but new ones won't because of this setting.

From a consumer perspective, they've authorized it and in many cases an admin has granted approval for the application only to still have it not work for some hard to know reason (this setting).

The OAuth grant should allow for SMTP, and at the least have a clear spot in azure admin to toggle SmtpClientAuthenticationDisable .

As an application developer, I must say that the experience with conflicting, unclear documentation and the UX/UI of the admin portals have been the biggest challenge in interfacing with OAuth setup.

"...and at the least have a clear spot in azure admin to toggle SmtpClientAuthenticationDisable "

Dead right Anthony Gentile_FUB.

When I read that new tenants - and probably tenants that up until now have not used it - were to have Basic Authentication disabled for SMTP, I assumed that MSFT would at least make it relatively simple to re-enable it.

Timme B81 has done us all a great favour in demonstrating how to do it. Many thanks.

Perhaps MSFT do not realise the scale and disruption of forcing a conversion from SMTP Basic Authentication to Oauth2 in this way. And they haven't - and probably won't - produce a PHP version of MSAL, and that screws up the large number of apps (from the simple Contact form upwards) that email out of PHP on an Apache or similar back-end.

Hi all,

As mentioned above, the SMTP AUTH protocol is now disabled by default for new organisations onboarding to Microsoft 365/Office 365/Exchange Online. This was announced here: 

https://techcommunity.microsoft.com/t5/exchange-team-blog/securing-authenticated-smtp-in-exchange-online/ba-p/1293154

The change uses two settings, an organisation setting (SmtpClientAuthenticationDisabled) , and per-mailbox settings (Under Manage Email Apps or the ) to allow admins to finetune what mailboxes have this protocol enabled. with the per-mailbox settings overriding the organsation setting such that you only need to enable mailboxes that need to use the protocol and allow the others to remain secured and disabled. 

You can learn who to change these in the document shared above: 

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission 

For reference, the main support document that offers advice on how to configure devices and clients like Wordpress sites to send emails can be found here: 

https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365

We added a note warning about SMTP AUTH being disabled to it as part of this change in behaviour. 

Regarding basic authentication, just to be clear, this is a protocol-based setting and it disables SMTP AUTH, regardless of whether basic auth or OAuth is being used.

The 17th July 2020 doc Option 1 (recommended): “Authenticate your device or application directly with a Microsoft 365 or Office 365 mailbox, and send mail using SMTP AUTH client submission” confused me, and I think the confusion comes from my being unable to distinguish when the doc is referring to SMTP AUTH with Basic Authentication or SMTP AUTH with Oauth2 (or both!).

Your comment “Regarding basic authentication … this is a protocol-based setting and it disables SMTP AUTH, regardless of whether basic auth or OAuth is being used” is a minor bombshell and confuses me further. MSFT’s original announcement was that Basic Authentication was deprecated and would be discontinued early this year, with the discontinue date then being moved to later in 2021. We were guided to replace Basic Authentication by Modern Authentication (aka Oauth2). Your comment above implies that EITHER form of authentication* is deprecated – that SMTP itself will be blocked! If so, what is the recommended replacement?

* to be pedantic: for ‘Oauth2’ read openid authentication with Oauth2 authorisation