Home › Guides › Office 365 SMTP settings: what they are now, and which ones work for devices

Reference

Office 365 SMTP settings: what they are now, and which ones work for devices

Searching for the Office 365 SMTP settings usually means a printer, scanner, UPS, NAS or application has stopped sending. Here are the current settings for every method Microsoft 365 supports, which devices each one works for, and the honest answer for the devices none of them fit.

The settings, method by method

Method	Server	Port	Encryption	Authentication	Works for
SMTP AUTH client submission	`smtp.office365.com`	587 (25 also accepted)	STARTTLS, TLS 1.2 or later	OAuth2 only; username and password (basic authentication) no longer accepted	Applications updated for OAuth2 and a few current MFP models. Not ordinary printers, UPSs, NAS or server cards.
Direct Send	Your tenant's MX host, e.g. `yourdomain-com.mail.protection.outlook.com` (see the MX record for your domain)	25	Optional (opportunistic TLS)	None	Internal recipients only, from your own public IP, and only while the tenant has not enabled Reject Direct Send. Being phased out.
SMTP relay connector	Your tenant's MX host	25	Optional	None; the connector trusts your static public IP or a certificate	Any recipient, from a site with a static public IP and an Exchange administrator to create the connector.
Relay on your LAN (SMTP-365)	The appliance's IP address on your network	2525 or 25	None needed on the LAN	None on the device; the appliance uses an OAuth2 application identity to Microsoft	Every printer, scanner, UPS, iLO/iDRAC, NAS, PBX and application on the site. Also scan to SharePoint.

The settings people remember, and why they stopped working

For a decade the answer was: smtp.office365.com, port 587, STARTTLS, the mailbox's username and password. Those settings are still correct for the server and port. What changed is that Microsoft retired basic authentication for SMTP submission, so the username and password are refused with 535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant. Re-entering the password, enabling SMTP AUTH on the mailbox, or turning off MFA does not help: the method itself is gone, and a device cannot obtain the OAuth2 token that replaced it. Details in what Microsoft changed.

Choosing

An application you can update (a web app, a script, a monitoring tool with OAuth2 support): use SMTP AUTH with OAuth2, or better, Microsoft Graph's sendMail.
One device, static public IP, Exchange admin available, internal and external recipients: an SMTP relay connector is Microsoft's free answer.
Printers and devices on an office network: a relay on the LAN. The devices get server-and-port settings with no login and no TLS, exactly what they were built for, and one appliance covers all of them.
Direct Send: avoid for anything new. It is unauthenticated, internal-only, and tenants are turning it off.

Device settings for a LAN relay

Once SMTP-365 is running, every device gets the same three values: the appliance's IP address, port 2525 (or 25), authentication off and encryption off. The sender address is any real mailbox in your tenant; the appliance can force it so every message comes from one scanner or alerts mailbox. Brand-specific screens: Canon · Ricoh · Konica Minolta · Xerox · HP · Kyocera · Brother · UPS · iDRAC and iLO · Synology and QNAP · 3CX.