Microsoft 365 SMTP settings: smtp.office365.com, port 587, SMTP AUTH vs relay
The three ways to send from Microsoft 365: SMTP AUTH client submission (smtp.office365.com:587), direct send, and an SMTP relay connector. Exact settings, limits (10,000 recipients/day, 30/min), and the 5.7.139 / 5.7.57 fixes.
Microsoft 365 / Office 365 outgoing mail server:
smtp.office365.com, port <code>587</code> (STARTTLS) or <code>25</code> (STARTTLS), username = the licensed mailbox address, password = the mailbox password.
Microsoft 365 / Office 365 SMTP settings at a glance
| Outgoing (SMTP) host | smtp.office365.com (SMTP AUTH) — or yourdomain-com.mail.protection.outlook.com (direct send / relay connector) |
|---|---|
| Ports & encryption |
587 — STARTTLS <em>(SMTP AUTH client submission)</em>25 — STARTTLS <em>(direct send and connector relay only)</em> |
| Username | the licensed mailbox address, e.g. app@yourdomain.com |
| Password | the mailbox password (or an app password if MFA is on and Security Defaults allow it) |
| Authentication | SMTP AUTH is disabled tenant-wide on new tenants. An admin must enable it per mailbox (Microsoft 365 admin center → Users → mailbox → Mail → Manage email apps → Authenticated SMTP) and Security Defaults must not block legacy auth. Microsoft has announced that basic auth for SMTP AUTH client submission will be retired (2025) in favour of OAuth — plan for it. |
How to set up Microsoft 365 / Office 365 SMTP
- Admin center → Users → Active users → select the sending mailbox → Mail tab → "Manage email apps" → tick "Authenticated SMTP" → Save.
- If Security Defaults are on (Entra ID → Properties → Manage security defaults) either turn them off or use Conditional Access that allows legacy auth for that account.
- Configure the app: host smtp.office365.com, port 587, STARTTLS, username = mailbox address, password = mailbox password/app password. The From address must be that mailbox or an alias it has Send As rights for.
- For a device that cannot authenticate: create an SMTP relay connector (Exchange admin center → Mail flow → Connectors → From: your organization's email server → To: Microsoft 365, identify by your public IP), then send to yourdomain-com.mail.protection.outlook.com on port 25.
Sending limits
- SMTP AUTH: 10,000 recipients per day per mailbox, 30 messages per minute, 500 recipients per message.
- Direct send: only to recipients inside your own tenant, 30/min, no authentication, sent from your server's public IP (must be in SPF).
- Relay connector: external recipients allowed, needs a connector tied to your static public IP or certificate, still rate limited.
Things that catch people out
- A shared mailbox has no licence and cannot use SMTP AUTH; use a licensed mailbox.
- 30 messages/minute is enforced hard — batch jobs need to sleep or use a proper sending service.
- Direct send messages to external domains are rejected with 550 5.7.64 Relay Access Denied.
Common Microsoft 365 / Office 365 SMTP errors
| Server reply | Meaning | Fix |
|---|---|---|
535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant/Mailbox | SMTP AUTH is off. | Enable "Authenticated SMTP" on the mailbox (or tenant-wide via PowerShell Set-TransportConfig -SmtpClientAuthenticationDisabled $false). |
5.7.57 Client not authenticated to send mail | AUTH not sent or wrong, often on the wrong port. | Use port 587 with STARTTLS and send credentials. |
550 5.7.60 Client does not have permissions to send as this sender | From address differs from the authenticated mailbox. | Send as the mailbox, or grant Send As / use an alias. |
432 4.3.2 STOREDRV.Deliver; recipient thread limit exceeded / 4.7.500 Server busy | Rate limit (30/min). | Throttle to <30 messages per minute or relay through a sending service. |
More codes: 535 authentication failed, 550 relay denied, 554 rejected as spam, connection timed out — or all SMTP error codes.
When Microsoft 365 / Office 365 is not enough for your app
When a provider caps you or blocks a port, point the same app at QueenSMTP instead: host smtp.queensmtp.com, port 587 (STARTTLS) or 465 (SSL), your SMTP username and password from the dashboard. $5/year plus $0.10 per 1,000 emails, 100 free a day to test.
Get SMTP credentials — free to test Test Microsoft 365 / Office 365 nowRelated settings
Microsoft 365 / Office 365 SMTP — questions
smtp.office365.com on port 587 with STARTTLS, authenticating with a licensed mailbox. Direct send and relay connectors use yourdomain-com.mail.protection.outlook.com on port 25 instead.
In the Microsoft 365 admin center open the user, Mail tab, "Manage email apps", and tick Authenticated SMTP. Security Defaults must allow it.
Not realistically: 30 messages per minute and 10,000 recipients per day per mailbox, and Microsoft throttles bulk patterns. Use a sending service for newsletters and notifications.
Related Guides
Continue learning with these related articles