Clarification on Office365 SMTP with MFA

Question

Hi,

My application uses an Office365 account to send emails via SMTP with username and password using the MailKit library. From October 1, 2025, onwards, MFA will be mandatory for Office365 accounts. Will my existing application continue to work without any changes?

Thanks,

Anil M.R

Answer 1

Thank you for reaching out regarding your application's use of Office 365 SMTP with MailKit.

Starting October 1, 2025, Microsoft will enforce Multi-Factor Authentication (MFA) and retire Basic Authentication for SMTP Client Submission (SMTP AUTH). This means that using a username and password alone to authenticate SMTP connections will no longer work. Your current setup with MailKit will not continue to work without changes.

To ensure uninterrupted email delivery, you’ll need to migrate to OAuth 2.0 authentication, which supports MFA and aligns with Microsoft’s security requirements.

Step-by-Step Procedure to Update Your Application

1. Confirm OAuth Support in MailKit
   • MailKit supports OAuth 2.0. Ensure you're using the latest version of the library.
   2. Register Your Application in Azure AD

• Go to the Azure Portal.
• Navigate to Azure Active Directory > App registrations.
• Click New registration and provide a name for your app.
• Set the redirect URI (can be a placeholder if not using interactive login).

3. Configure API Permissions

• Under your app registration, go to API permissions.
• Add Microsoft Graph > Mail.Send permission.
• Grant admin consent if needed.

4. Generate Client Credentials

• Under Certificates & secrets, create a client secret.
• Note the Application (client) ID, Directory (tenant) ID, and client secret—you’ll need these for token generation.

5. Acquire OAuth 2.0 Token

• Use Microsoft’s token endpoint to request an access token POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token Include:
• client_id
• client_secret
• scope: https://outlook.office365.com/.default
• grant_type: client_credentials

6. Update MailKit Code to Use OAuth

• Replace the username/password authentication with the OAuth token var oauth2 = new SaslMechanismOAuth2("******@domain.com", accessToken); smtpClient.Authenticate(oauth2);

7. Test Thoroughly

• Validate that your application can send emails using the new OAuth flow.
• Monitor for any SMTP errors like 550 5.7.30 Basic authentication is not supported