How to enable App-only (client_credentials) SMTP send in Office 365 without using PowerShell?

Question

Hi,

I’m trying to send emails using Office 365 SMTP with App-only (client_credentials) OAuth 2.0.

I can generate a valid access token with SMTP.SendAsApp, IMAP.AccessAsApp, and POP.AccessAsApp,

but SMTP always fails with:

535 5.7.3 Authentication unsuccessful

I'm attaching the screenshot of the error below.

We don’t want to use PowerShell.

Our admin is ready to give the required permissions, but we want to do it through the Microsoft 365 admin portal or Exchange admin center — not with command line commands.

Question**

Is there any way to enable App-to-App SMTP or AllowServicePrincipalSmtpAuth directly in the Microsoft 365 Admin Center or Exchange Admin Center without PowerShell?

Thanks,

Siva Matta

Answer 1

There are several things to configure here. First, SMTP Auth must be enabled, and if you are going to use the app-only scenario, it needs to be enabled tenant-wide. This can be done either in the UI or via PowerShell, instructions are here: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission

Next are the authentication bits, which you seem to have configured correctly. Just in case, you can share the sanitized token with us to verify.

On the authorization layer, there are few ways to control access on Exchange side of things. Application access policies are the "old" way, but can still be used, so you need to check for those. This is only possible via PowerShell currently: https://practical365.com/application-access-policies-in-exchange-online/

The "new" way is via the so-called RBAC for applications. Part of the setup process for it requires that a matching service principal for your app is provisioned in Exchange Online. Unfortunately, this step is also possible only via PowerShell, no other way around it.

Once a service principal is provisioned, you can either assign mailbox-level permissions (https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/smtp-app-rbac-onboarding) or grant access via management scopes... again via PowerShell: https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#use-client-credentials-grant-flow-to-authenticate-smtp-imap-and-pop-connections