Outlook SMTP settings: servers, ports and the auth change

For a Microsoft 365 mailbox: smtp.office365.com, port 587, STARTTLS, username is the full address. For a personal Outlook.com, Hotmail or Live account: smtp-mail.outlook.com, port 587, STARTTLS. Those settings have been stable for years. What changes, and what breaks setups, is authentication.

Quick reference

Port 25 is not a submission port and is widely blocked outbound by hosting providers and ISPs. Port 465 with implicit TLS is not the documented option for Microsoft's submission endpoints — use 587 with STARTTLS.

The authentication situation, stated carefully

Microsoft has been retiring Basic authentication across Exchange Online for years: it was disabled for most protocols in 2022, and Microsoft has continued the retirement into SMTP AUTH client submission, with OAuth 2.0 as the supported replacement. Personal Outlook.com accounts have also moved away from password-based access in third-party clients.

The honest advice, rather than a date: assume a plain username and password will stop working, and check your own tenant's current state in the Microsoft 365 admin centre before building anything on it. If you are writing an integration, use OAuth 2.0. For high-volume application mail, Microsoft's own guidance points at its High Volume Email feature and the Graph API rather than SMTP submission.

A password-based setup that works today may fail after a tenant change you did not make. That is the risk you are accepting, not a reason to panic.

The per-mailbox setting nobody finds

Even with correct credentials and ports, Microsoft 365 submission fails if SMTP AUTH is disabled — and it is disabled by default for new tenants at the organisation level. The error is clear once you know the cause:

535 5.7.3 Authentication unsuccessful
451 4.7.0 Temporary server error. Please try again later. PRX5
550 5.7.60 SMTP; Client does not have permissions to send as this sender

Check and enable it in Exchange Online PowerShell:

Connect-ExchangeOnline
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -Identity test@mailpilots.in | Format-List SmtpClientAuthenticationDisabled
Set-CASMailbox -Identity test@mailpilots.in -SmtpClientAuthenticationDisabled $false

The organisation-level setting and the per-mailbox setting are separate, and the mailbox value overrides the tenant default. Enable it per mailbox rather than tenant-wide: SMTP AUTH with Basic authentication is the single most attacked surface in Exchange Online, and leaving it open everywhere is how password-spray attacks succeed.

Security defaults and conditional-access policies can also block legacy submission regardless of these settings. If PowerShell says SMTP AUTH is enabled and authentication still fails, look there next.

Test the transport on its own

openssl s_client -starttls smtp -crlf -connect smtp.office365.com:587

You should see a 220 banner, then after EHLO yourdomain.com a capability list containing STARTTLS and AUTH LOGIN XOAUTH2. If that works and your application still fails, the problem is credentials, the mailbox toggle or a policy — not the network. If the handshake itself fails, check outbound port 587, then your CA trust store: an old server with a stale ca-certificates package fails TLS verification against modern chains.

Sender restrictions

Microsoft will not let a mailbox send as an arbitrary address. The From must be the authenticated mailbox, or an address it has explicit *Send As* or *Send on Behalf* permission for. A shared mailbox needs that permission granted, not just access. The 550 5.7.60 error above is this rule, not a configuration mistake.

IMAP and POP

Use IMAP. It keeps state on the server, so several clients see the same mailbox, folders and read status. POP3's traditional behaviour is to download and remove, which makes any multi-client setup lose mail — choose it only for a deliberate one-way archive, and even then set the client to leave messages on the server.

Both protocols are also affected by the move away from Basic authentication, and both can be disabled per mailbox:

Get-CASMailbox -Identity test@mailpilots.in | Format-List ImapEnabled,PopEnabled

Troubleshooting map

What not to do

• Do not build a new integration on a username and password. Use OAuth 2.0.
• Do not enable SMTP AUTH tenant-wide to fix one mailbox.
• Do not disable TLS verification to clear a certificate error. Update the trust store instead.
• Do not use a Microsoft 365 mailbox as a bulk mail transport. It is a mailbox, has per-mailbox recipient limits, and Microsoft's filters treat high-volume mailbox sending as what it looks like.
• Do not store credentials in client-side code or a repository.

MailPilot connects Microsoft 365 and Outlook mailboxes over OAuth, so there is no password or app secret to rotate, and it also supports SMTP/IMAP for providers that need it — checking SPF, DKIM and DMARC on the sending domain before warm-up starts.