Assign a License: To use SMTP, the account must have an Exchange Online license (even the cheapest "Exchange Online Kiosk" plan works). Free or unlicensed accounts generally cannot use the SMTP server for outgoing mail.
2. Enable "Authenticated SMTP" (The Critical Step)
By default, Microsoft disables SMTP for security. You must turn it on manually for that specific user:
In the Active Users list, click on your new user.
Go to the Mail tab.
Click Manage email apps.
Check the box for Authenticated SMTP.
Click Save changes.
3. Handle Modern Authentication (OAuth vs. App Passwords)
Since we are in 2026, simple passwords often fail due to "Security Defaults."
If your app supports OAuth 2.0: Register the app in Microsoft Entra ID (formerly Azure AD) and use the Client ID/Secret.
If your app only supports Username/Password: You must enable Multi-Factor Authentication (MFA) and then generate an App Password. (Go to My Account > Add Method > App Password).
Part 2: Integration Settings for Your Application
Use these standard settings in your application's code or configuration:
Setting
Value
SMTP Server
smtp.office365.com
Port
587
Encryption
STARTTLS (Required)
Authentication
Yes
Username
Your full email (e.g., sender@yourdomain.com)
Password
Your App Password (not your regular login password)
Part 3: Issues with "Free" Accounts
If you try to use a free @outlook.com or @hotmail.com account for this:
SMTP Disabled: As of late 2024/2025, Microsoft has largely disabled SMTP for free accounts to prevent spam.
Low Sending Limits: Even if you get it working, free accounts are capped at very low daily limits (often around 300 recipients per day).
IP Reputation: Free accounts often get flagged as "low reputation," meaning your application's emails will likely land in the recipient's Spam folder.
No Admin Control: You cannot "Enable Authenticated SMTP" in a free account because you lack access to the Admin Center.
Part 4: Common Problems & Troubleshooting
Error 535 (Authentication Failed): Usually means Authenticated SMTP is disabled in the Admin Center (Step 2) or you aren't using an App Password.
Error 5.7.139 (Security Defaults): This happens if your organization has "Security Defaults" turned on. You must use OAuth 2.0 or disable Security Defaults (not recommended) to use basic SMTP.
Connection Timeout: Ensure your server/hosting provider hasn't blocked Port 587. Some providers (like AWS or Azure) block this port by default to prevent spam.
Daily Limits: A standard Microsoft 365 mailbox is limited to 10,000 recipients per day. If you exceed this, your account will be "jailed" for 24 hours.
