I have granted permission in App registration to an App but it is showing SMTP error

Question

I have granted permission in App registration to an App but it is showing SMTP error

Faruq Bello 20

We are integrating a PHP web application to send emails via SMTP using the modern OAuth 2.0 (XOAUTH2) flow for the account: PII. The Issue: We have successfully registered the Azure App. We have successfully granted Admin Consent for the delegated SMTP.Send and offline_access scopes. Our application successfully fetches a valid OAuth Access Token specifically bound to the no_reply UPN. However, when the application attempts the SMTP handshake on smtp.office365.com:587, it is immediately rejected with: 535 5.7.3 Authentication unsuccessful. What we have already checked: "Authenticated SMTP" is CHECKED under the active user's Mail ] Manage Email Apps setting. Security Defaults are DISABLED for the tenant. The Global Modern Auth setting ("Allow access to basic authentication protocols") has "Authenticated SMTP" CHECKED. We believe this account is being blocked by a hidden Conditional Access policy enforcing MFA, or the SMTP enablement has not propagated on the backend Exchange servers. Could you please review the backend logs for PII and help us exclude this service account from whatever policy is blocking the SMTP AUTH?

Rukmini 29,300 Reputation points Microsoft External Staff Moderator

2026-02-27T07:50:39.41+00:00

Hello Faruq Bello

We will investigate the issue and update you with the findings. Thank you for your patience as we look into this.
Shubham Sharma 10,725 Reputation points Microsoft External Staff Moderator

2026-02-27T12:01:25.0966667+00:00
Hi Faruq Bello

Thank you for reaching out to Microsoft Q&A.

it looks like you’ve got your app registered and you’re successfully pulling an OAuth2 token, but the SMTP handshake on smtp.office365.com:587 is being rejected with “535 5.7.3 Authentication unsuccessful.” That error almost always means one of two things:

The token you’re presenting isn’t scoped for SMTP (or the wrong resource/audience).

A Conditional Access policy (or Security Defaults–style policy) is blocking “Authenticated SMTP” for that user.

Here’s what you can try to narrow this down and get your no_reply account sending via XOAUTH2:

Validate your token’s scope & audience

Paste your access token into https://jwt.ms (or jwt.io) and check: • “scp” should include SMTP.Send • “aud” should be outlook.office365.com (not graph.microsoft.com)

If it’s wrong, make sure in your v2.0 auth request you’re asking for: scope=https://outlook.office365.com/SMTP.Send offline_access

Check Azure AD Sign-in logs for the SMTP attempt

In the Azure portal go to Azure AD → Sign-ins

Filter by your no_reply UPN and look for the “Client app” entry called “Authenticated SMTP”

Click into the failure—under “Conditional Access” you’ll see if a policy is denying the request and why

If you see it’s blocked by Conditional Access

You can’t carve out a single account under Security Defaults, so you’ll need to switch to a Custom Conditional Access policy where you exclude this service account from any MFA/legacy-protocol rules

Alternatively, if you don’t actually need delegated user context, consider granting the SMTP.Send Application permission and using client-credentials flow (that avoids CA on a user entirely)

Double-check mailbox settings

In Exchange admin center, confirm under Mail → Manage email apps that Authenticated SMTP is enabled for that mailbox

Sometimes it can take a few minutes to propagate behind the scenes

Follow-up questions to narrow it further:

In your Sign-in logs, what exactly is the “Failure reason” and “Conditional Access” detail for the SMTP entry?

Can you share (redacted) a screenshot of the log entry showing “Client app = Authenticated SMTP”?

When you decode the token, what are the full “scp” and “aud” claims?

Are you using username/password or client_id/client_secret in your auth request?

References

Troubleshoot SMTP authN with Security Defaults blocking SMTP: https://learn.microsoft.com/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365#smtp-authentication

Authenticate an IMAP, POP or SMTP connection using OAuth: https://learn.microsoft.com/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

Microsoft identity platform scopes & consent: https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent

Delegate vs. application permissions for SMTP.Send: https://docs.microsoft.com/azure/active-directory/develop/delegated-and-app-perms

Hope this helps you pinpoint what’s blocking the SMTP handshake! Let me know what you see in the sign-in logs and we’ll go from there.
Faruq Bello 20 Reputation points

2026-03-02T08:49:44.8733333+00:00

Hello...
Faruq Bello 20 Reputation points

2026-03-02T08:51:03.7366667+00:00

Hello, I have pasted the token where you asked me to in step one, but there is nothing being displayed in the decoded token or in claims.
Shubham Sharma 10,725 Reputation points Microsoft External Staff Moderator

2026-03-02T08:52:18.7533333+00:00
Hello Faruq Bello

Thank you for your reply.

jwt.ms can only decode JWTs (3 dot‑separated Base64URL segments):

header.payload.signature

Microsoft Entra access tokens for Exchange Online SMTP are JWTs, and should always decode and show claims like:

aud

scp

iss

upn

tid

If nothing appears, Microsoft docs and community cases show one of these is true:

We are not pasting the real access token

Very common mistakes:

Pasting the authorization code

Pasting a refresh token

Pasting the entire JSON response

Pasting a token that was URL‑encoded / truncated

Microsoft explicitly states that only the access_token value is used for SMTP AUTH and is a JWT. Refresh tokens are opaque and will not decode

For your reference: https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

We requested the token for a wrong resource: -

If the token audience is Microsoft Graph, SMTP will reject it and jwt.ms may not show Exchange claims.

For SMTP AUTH, Microsoft requires:

aud = https://outlook.office365.com scope = https://outlook.office365.com/SMTP.Send

If you requested:

scope = https://graph.microsoft.com/.default

You will get a Graph token, which:

Works with Graph APIs

Does NOT work with smtp.office365.com

Causes 535 5.7.3 Authentication unsuccessful

Correct token request: -

Authorization request

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize

?client_id=XXXX

&response_type=code

&redirect_uri=XXXX

&scope=https://outlook.office365.com/SMTP.Send offline_acces

Token request: -

POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code

client_id=XXXX

client_secret=XXXX

code=XXXX

redirect_uri=XXXX

scope=https://outlook.office365.com/SMTP.Send offline_access

https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

When things are correct, jwt.ms will decode immediately and show something like:

{

"aud": "https://outlook.office365.com",

"scp": "SMTP.Send",

"upn": "******@yourdomain.com",

"idtyp": "user",

"iss": "https://sts.windows.net/{tenant-id}/",

"tid": "{tenant-id}"

}

If aud is graph.microsoft.com → SMTP will fail

If scp does not include SMTP.Send → SMTP will fail

If jwt.ms is blank → you are not using an access token

Why SMTP rejects with 535 even though “everything is enabled”

Microsoft confirms SMTP AUTH with OAuth will still fail if any of these are true:

Token audience is wrong (Graph vs Outlook) most common

Token is not a JWT (refresh token / code pasted)

Conditional Access blocks “Authenticated SMTP”

User‑based CA policy enforces MFA

Microsoft Learn explicitly calls out Conditional Access blocking SMTP OAuth attempts and recommends either:

Excluding the mailbox from CA, or

Using Application permissions + client credentials to bypass user CA entirely

If this is a service account (no_reply) and does not require user interaction:

Switch to Application permissions (NO user CA impact)

Permission: SMTP.SendAsApp

Flow: client_credentials

Audience: https://outlook.office365.com/.default

https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/oauth-high-volume-mails-m365
Faruq Bello 20 Reputation points

2026-03-02T12:35:06.2666667+00:00

Thanks, I checked and found that it was refresh token that I paste. So how do I generate an access token value
Shubham Sharma 10,725 Reputation points Microsoft External Staff Moderator

2026-03-03T08:48:24.2733333+00:00
Faruq Bello

Thank you for your reply.

Below is generate a valid Exchange Online SMTP access token: -

SMTP AUTH only accepts the access_token value returned by the /token endpoint.

access_token → JWT → decodes in jwt.ms → works with SMTP

refresh_token → opaque → will NOT decode → SMTP rejects

authorization code → one‑time code → not a token

Entire JSON response → invalid

Microsoft explicitly documents this behavior for SMTP OAuth.

For your reference: https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

Option 1 — User‑based SMTP (Authorization Code flow)

Use this only if the mailbox is a real user and interactive sign‑in is acceptable.

Step 1: Get an authorization code (browser)

GET https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize

?client_id=CLIENT_ID

&response_type=code

&redirect_uri=REDIRECT_URI

&scope=https://outlook.office365.com/SMTP.Send offline_access

&response_mode=query

User signs in

You receive ?code=XXXX

This code is NOT the token

It is exchanged for tokens in step 2

Step 2: Exchange the code for tokens (this is where access_token comes from)

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

Content-Type: application/x-www-form-urlencoded

client_id=CLIENT_ID

client_secret=CLIENT_SECRET

grant_type=authorization_code

code=AUTHORIZATION_CODE

redirect_uri=REDIRECT_URI

scope=https://outlook.office365.com/SMTP.Send offline_access

Successful response (example)

{

"token_type": "Bearer",

"expires_in": 3599,

"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIs...",

"refresh_token": "0.AAAABBBBB..."

}

Copy only access_token

Paste that value into https://jwt.ms

Use that same value for SMTP AUTH

Microsoft documents this flow and scope requirement explicitly.

https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

What the decoded token MUST show

When pasted into jwt.ms:

{

"aud": "https://outlook.office365.com",

"scp": "SMTP.Send",

"upn": "******@yourdomain.com",

"idtyp": "user",

"iss": "https://sts.windows.net/{tenant-id}/",

"tid": "{tenant-id}"

}

If any of these are wrong, SMTP will fail.

Option 2 — Service account / no user login

If this is a no_reply / service mailbox, do NOT use user auth.

Use Client Credentials flow instead (no MFA, no CA impact).

Required permission

SMTP.SendAsApp (Application permission)

Admin consent required

Microsoft explicitly supports this for SMTP.

Token request (client cred)

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

Content-Type: application/x-www-form-urlencoded

client_id=CLIENT_ID

client_secret=CLIENT_SECRET

grant_type=client_credentials

scope=https://outlook.office365.com/.default

Response: -

{

"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIs..."

}

Paste access_token into jwt.ms

aud will be https://outlook.office365.com

roles will include SMTP.SendAsApp

Works with smtp.office365.com

Note: -

Token has 3 dots

jwt.ms decodes immediately

aud = https://outlook.office365.com

scp = SMTP.Send or roles = SMTP.SendAsApp
Shubham Sharma 10,725 Reputation points Microsoft External Staff Moderator

2026-03-06T08:51:33.1533333+00:00

Faruq Bello

Following up to check if the resolution provided above was helpful. Please let us know if you need any further assistance.
Faruq Bello 20 Reputation points

2026-03-06T08:57:52.8866667+00:00

Thanks, Shubham,

I will get back to you if any further guidance is needed or if I notice anything once I pass it on to the person in charge.

1 answer

Your answer

Rukmini 29,300 Reputation points Microsoft External Staff Moderator

2026-02-27T07:50:39.41+00:00

Hello Faruq Bello

We will investigate the issue and update you with the findings. Thank you for your patience as we look into this.
Faruq Bello 20 Reputation points

2026-03-02T08:49:44.8733333+00:00

Hello...
Faruq Bello 20 Reputation points

2026-03-02T08:51:03.7366667+00:00

Hello, I have pasted the token where you asked me to in step one, but there is nothing being displayed in the decoded token or in claims.
Faruq Bello 20 Reputation points

2026-03-02T12:35:06.2666667+00:00

Thanks, I checked and found that it was refresh token that I paste. So how do I generate an access token value
Shubham Sharma 10,725 Reputation points Microsoft External Staff Moderator

2026-03-06T08:51:33.1533333+00:00

Faruq Bello

Following up to check if the resolution provided above was helpful. Please let us know if you need any further assistance.
Faruq Bello 20 Reputation points

2026-03-06T08:57:52.8866667+00:00

Thanks, Shubham,

I will get back to you if any further guidance is needed or if I notice anything once I pass it on to the person in charge.

Answer 1

Faruq Bello 20

Hello, I have pasted the token where you asked me to in step one, but there is nothing being displayed in the decoded token or in claims.

Share via

I have granted permission in App registration to an App but it is showing SMTP error

1 answer

Your answer