SMTP AUTH XOAUTH2 (Client Credentials) fails with 535 5.7.3 despite correct SMTP.SendAsApp permission

Summary

A third-party system (Keycloak, identity provider) is attempting to authenticate via SMTP AUTH using OAuth 2.0 (XOAUTH2) with the Client Credentials Grant (app-only, no signed-in user) against smtp.office365.com:587, in order to send transactional emails from the mailbox [Moderator note: Personally Identifiable Information removed]@buergerbauverein-muenchen.de.

Authentication consistently fails with:

535 5.7.3 Authentication unsuccessful

Important: The exact same access token (same app, same client credentials flow) works fine when sending mail via the Microsoft Graph API (POST /v1.0/users/{id}/sendMail). The problem only occurs with the classic SMTP AUTH protocol.

Tenant and app information

FieldValueTenant ID**[Moderator note: Personally Identifiable Information removed]----------------Tenant ID[Moderator note: Personally Identifiable Information removed]Affected organizationBuergerbauverein Muenchen eGApp registration (name)Keycloak SMTP OAuthApplication (client) ID[Moderator note: Personally Identifiable Information removed]Affected mailbox[Moderator note: Personally Identifiable Information removed]**@buergerbauverein-muenchen.deSMTP host/portsmtp.office365.com / 587 (StartTLS)Token endpointhttps://login.microsoftonline.com/9918365a-4c1e-4bdc-bc8e-e2971ba53c7b/oauth2/v2.0/tokenScope usedhttps://outlook.office.com/.default## Error correlation ID (most recent, representative failure, after all fixes below were applied)

535 5.7.3 Authentication unsuccessful
[

Additional correlation IDs from earlier test runs during troubleshooting (identical error, different timestamps):

[``[Moderator note: Personally Identifiable Information removed]``]

[``[Moderator note: Personally Identifiable Information removed]``]

[``[Moderator note: Personally Identifiable Information removed]``]

Troubleshooting steps already completed

The following have been systematically verified as correctly configured — the error persists unchanged regardless:

[x] SMTP.SendAsApp API permission under Office 365 Exchange Online, added as an Application permission, admin consent granted (status: "Granted")

[x] Token acquisition via client credentials grant tested successfully — decoded JWT correctly contains roles: [Mail.Send, SMTP.SendAsApp, MailboxSettings.Read] and aud: https://outlook.office.com

[x] Application Access Policy created (New-ApplicationAccessPolicy), scoped to the affected mailbox

[x] Test-ApplicationAccessPolicy -AppId "``[Moderator note: Personally Identifiable Information removed]``" -Identity [Moderator note: Personally Identifiable Information removed]@buergerbauverein-muenchen.de → result: AccessCheckResult: Granted

[x] Authenticated SMTP enabled for the mailbox (Set-CASMailbox -SmtpClientAuthenticationDisabled $false, also confirmed/enabled via the admin center GUI)

[x] Security Defaults disabled tenant-wide (for testing purposes)

[x] Verified correct scope (https://outlook.office.com/.default, not .office365.com)

[x] Restarted the Keycloak service to rule out a cached/stale token

[x] Comparison test via Microsoft Graph API (sendMail endpoint) using the identical client credentials flow (separate Mail.Send Application permission under Microsoft Graph, admin consent granted) → succeeded, no error, email was delivered

Question for the community / Microsoft support

Why is authentication rejected at the classic SMTP AUTH endpoint (smtp.office365.com:587, XOAUTH2) with an app-only token (client credentials flow) — 535 5.7.3 — even though:

the SMTP.SendAsApp permission is correctly configured as an Application permission with admin consent,

the Application Access Policy demonstrably grants access to the mailbox (Test-ApplicationAccessPolicy → Granted),

Authenticated SMTP is enabled for the mailbox,

the exact same token flow works without issue for sending mail via the Microsoft Graph API?

Is this a known limitation of app-only SMTP AUTH authentication, or is there a server-side tenant configuration issue? Any pointers appreciated.