Oauth2 for SMTP.Send granting AccessToken but returns 535: 5.7.3 Authentication unsuccessful when used

Will Wilding 150

Our application was updated late last year to support Oauth2 for obtaining (via IMAP) and sending (via SMTP) emails on behalf of outlook.com consumer accounts. (Edit: See responses below if experiencing the problem with Microsoft 365 accounts.)

We have both SAS and premise based deployments which were tested as able to send and receive in December 2022, but are now getting 5.7.3 Authentication unsuccessful when attempting to authenticate with the SMTP server. IMAP continues to work just fine.

Here's an example flow:

User is prompted for authorization:

https://login.microsoftonline.com:443/common/oauth2/v2.0/authorize?prompt=consent&response_type=code&state=59b234bd-fdc0-4905-8e57-bbd4b091cf4f&scope=https%3a%2f%2foutlook.office.com%2fSMTP.Send+https%3a%2f%2foutlook.office.com%2fIMAP.AccessAsUser.All+offline_access&access_type=offline&redirect_uri=http%3a%2f%2flocalhost%3a68%2fEmail%2foauth%2f&login_hint={outlook.com email address}&client_id={our registered + verified clientid}

The scopes are

https://outlook.office.com/SMTP.Send

https://outlook.office.com/IMAP.AccessAsUser.All

offline_access

We receive our callback after the user logs in and provides permission.

?code={access_code}&state=59b234bd-fdc0-4905-8e57-bbd4b091cf4f

Then call to exchange the access code for a token...

https://login.microsoftonline.com/common/oauth2/v2.0/token

client_id={client id}&code={access code}&redirect_uri=http%3a%2f%2flocalhost%3a68%2fEmail%2foauth%2f&grant_type=authorization_code

...and receive our access and refresh tokens in response.

{
  "token_type": "Bearer",
  "scope": "https://outlook.office.com/SMTP.Send https://outlook.office.com/IMAP.AccessAsUser.All",
  "expires_in": "3600",
  "ext_expires_in": "3600",
  "access_token": "{access_token}",
  "refresh_token": "{refresh_token}"
}

MailKit is then used to connect and authenticate to the IMAP server outlook.office365.com. No errors. New mail can be read from the user's inbox.

But attempting to authenticate the SMTP (again using MailKit) client results in "535: 5.7.3 Authentication unsuccessful"

The same SaSLMechanismOAuth2 with the account's email address and current access token are used for both.

Other notes:

Our Application ID / Client ID on Azure AD has been verified.
I haven't been able to identify any changes in our methodology since this was tested as working in December.
I tried some variations on the scope, such as including https://graph.microsoft.com/SMTP.Send but this made no difference.
I'd prefer not to use any separate Graph APIs for sending email as our product must communicate with other SMTP servers/providers
I'm aware that SMTP Authentication can still be used, but since we can no longer use basic authentication for IMAP or POP, I'd prefer not to store the user's credentials at all.
I added additional API permissions to our clientId but again no effect (screenshot below)

User's image

Akshay-MSFT 17,891 Reputation points Microsoft Employee

2023-02-08T11:14:29.5033333+00:00

@Will Wilding

Thank you for posting your query on Microsoft Q&A, I am currently reviewing this and will get back to you with further inputs.

Thanks,

Akshay Kaushik
Filip Navara 25 Reputation points

2023-02-08T11:21:31.49+00:00

Hi Akshay,

there's a duplicate report of the same issue (https://learn.microsoft.com/en-us/answers/questions/1168242/smtp-send-oauth-permission-not-working-for-consume). I posted a full code to reproduce the problem at https://github.com/filipnavara/Office365OAuthIsBrokenAgain.

Thanks,

Filip
Alex Zonis 70 Reputation points

2023-02-08T18:18:43.0466667+00:00

Hi @Akshay-MSFT ,
I have the same issue. I could send the email using the SMTP, but since Friday, Feb 3rd it stopped working. It started showing the error "535 5.7.3 Authentication unsuccessful". However, my program can still read emails.

Please let me know if you find the solution for the @Will Wilding.
wood 10 Reputation points

2023-02-15T04:37:14.69+00:00

Hi @Akshay-MSFT ,

I also encountered this problem. I am a mail client developer. At present, all functions sent by Microsoft Email are unavailable.
The error message returned is:
Authentication unsuccessful [TYCP286CA0214.JPNP286.PROD.OUTLOOK.COM 2023-02-09T14:31:14.036Z 08DB09400DE25F14]

Please let me know if you find the solution for this，thanks. @Alex Zonis @Filip Navara
Эдуард Терлецкий 20 Reputation points

2023-02-15T04:37:30.7566667+00:00

Hi guys, i have the same issue. Authentication unsuccessful [BE1P281CA0143.DEUP281.PROD.OUTLOOK.COM 2023-02-09T14:22:14.564Z 08DB099F3F3AD766]

Imap works fine, but smtp not
Эдуард Терлецкий 20 Reputation points

2023-02-15T04:37:42.2733333+00:00

@Will Wilding @Filip Navara @Akshay-MSFT @Alex Zonis
Hey, did anyone find a solution?
Alex Zonis 70 Reputation points

2023-02-15T19:15:14.16+00:00

No. I have been waiting for the answer. But it doesn't resolve the issue.
Our application is used by "common" tenants, that don't have work or school accounts, and they don't have the option to configure the email and set "Authenticated SMTP"

Armstrong Shi 5

Hi there, I also have this issue. here are screenshots of my setup and sample code.

AzurePortal_API_Permissions

AzurePortal_SecurityDefaults_Disabled

365AdminCenter_ActiveUser_Authenticated SMTP_Enabled

ExchangeAdminCenter_MailFlowSettings_TurnOffSMTPAuth_Unchecked

// acquire token
var scopes = new[] { "https://outlook.office.com/.default" };
var options = new TokenCredentialOptions
{
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
};

var clientSecretCredential = new ClientSecretCredential(tenantId, clientId, clientSecret, options);
Azure.Core.TokenRequestContext tokenRequestContext = new Azure.Core.TokenRequestContext(scopes);
Azure.Core.AccessToken accessToken = clientSecretCredential.GetToken(tokenRequestContext);

// send email
using (SmtpClient smtpClient = new SmtpClient())
{
    smtpClient.Connect("smtp.office365.com", 587, SecureSocketOptions.StartTls);

    // Exception: 535: 5.7.3 Authentication unsuccessful 
    // https://learn.microsoft.com/en-us/answers/questions/1168272/oauth2-for-smtp-send-granting-accesstoken-but-retu
    smtpClient.Authenticate(new SaslMechanismOAuth2(username, accessToken.Token));

    MimeMessage message = new MimeMessage();
    // to do: build message
    smtpClient.Send(message);

    smtpClient.Disconnect(true);
}

Will Wilding 150 Reputation points

2023-02-21T19:45:07.34+00:00

@Armstrong Shi I believe you're missing the https://outlook.office.com/SMTP.Send scope in your request. That may fix your problem. The issue we're trying to address impacts authentication on behalf Microsoft accounts like outlook.com and hotmail.com addresses.
Will Wilding 150 Reputation points

2023-02-21T19:48:16.1433333+00:00

@Akshay-MSFT Any further updates? The response did not address the authentication issue myself and others are experiencing with consumer outlook.com email accounts.
Armstrong Shi 5 Reputation points

2023-02-27T01:18:11.0066667+00:00
@Will Wilding Thank you for your response.

Yes, I added that scope.

var scopes = new[] { "https://outlook.office.com/.default", "https://outlook.office.com/SMTP.Send"};

But I got an exception when I requested token. "Microsoft.Identity.Client.MsalServiceException : AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://outlook.office.com/.default https://outlook.office.com/SMTP.Send is not valid."

I also tried to only include the scope "SMTP.Send", but I got another exception.

Microsoft.Identity.Client.MsalServiceException : AADSTS1002012: The provided value for scope https://outlook.office.com/SMTP.Send is not valid. Client credential flows must have a scope value with /.default suffixed to the resource identifier (application ID URI).

var scopes = new[] { "https://outlook.office.com/SMTP.Send" };
lubi22 35 Reputation points

2023-03-03T01:54:25.0566667+00:00

@Will Wilding

Just wondering, has this "authentication unsuccessfull" issue been fixed in your scenario? Thanks.
Valentin Mashchenko 5 Reputation points

2023-03-07T13:36:35.39+00:00

@Will Wilding hi! any updates?
Alex Zonis 70 Reputation points

2023-03-07T20:26:48.2366667+00:00

@Akshay-MSFT

Are there any updates? It is still not working. More and more people are facing the same error. Can it be fixed from the Microsoft side?
Enzo Tech 0 Reputation points

2023-04-19T01:43:05.6466667+00:00

Hello Any updates on this? When will Microsoft fix this issue?
Enzo Tech 0 Reputation points

2023-04-19T01:45:33.75+00:00

Hello @Akshay-MSFT When will Microsoft fix this issue? Until now it is still not working.
Enzo Tech 0 Reputation points

2023-04-19T01:49:46.5866667+00:00
Hello I am using the device code flow for OAuth2 for consumer account These are the endpoints I used to exchange the device code and get the token. Scope use are offline_access and SMTP.Send When using the access token, for SMTP, I still got this error 5.7.3 Authentication unsuccessful.

"device_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/devicecode", "token_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/token"
Cédric Counotte 6 Reputation points

2024-12-26T22:08:36.1366667+00:00

We're facing the same issue recently as our secret ID expired.

After creating a new secret, requesting a refresh token successfully, we are now getting error "535 5.7.3 Authentication unsuccessful" for no apparent reason.

Still double-checked all settings, all fine but security default was enabled so I disabled it but it didn't make any difference, I suppose because we are using secret/refresh token to authenticate.

The token gets refreshed after each connect, but there's no way to authenticate.

Any help would be appreciated.

3 answers

Will Wilding 150 Reputation points

2023-04-11T18:25:24.3566667+00:00

The issue with sending on behalf of outlook.com consumer addresses appears to have been resolved.
Please sign in to rate this answer.

2 people found this answer helpful.
Enzo Tech 0 Reputation points

2023-04-14T03:12:27.31+00:00

Hi @Will Wilding it is still not working. 535 5.7.3 Authentication unsuccessful [SJ0PR13CA0189.namprd13.prod.outlook.com 2023-04-14T01:41:59.958Z 08DB3BD5C46109BA] I am using offline_access and SMTP.Send as scope via Device Code Flow

Enzo Tech 0 Reputation points

2023-04-14T03:15:01.5133333+00:00

Hi @Will Wilding it is still not working. I am also using a consumer account too. Endpoints:

"device_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/devicecode", "token_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/token"

Brian C 0 Reputation points

2023-04-20T14:52:08.2466667+00:00

I can confirm that without making any changes on our end, our email app now just works, Microsoft must've fixed something

Enzo Tech 0 Reputation points

2023-04-30T08:53:24.5033333+00:00

Brian, are you using this OAUth2 Flow https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code? It seems it is still not working for this OAuth2 flow.

Alex Zonis 70 Reputation points

2023-05-17T15:54:45.44+00:00

I can confirm that the issue got resolved.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Akshay-MSFT 17,891 Reputation points Microsoft Employee

2023-02-15T09:05:24.5733333+00:00
@Will Wilding

Thanks for your time and patience. I was able to test this with Gmail and got authentication error as "SMTP AUTH" is disabled in your tenant, The issue was fixed after enabling Authenticated SMTP.

In your tenant kindly validate the following :

If Authenticated SMTP is enabled for your impacted user (this setting does over ride tenant configuration)

Navigate to https://admin.microsoft.com/Adminportal/Home?source=applauncher#/users

Select the user you are testing this with.

Ensure "Authenticated SMTP" is checked.

Please ensure to uncheck "Turn off SMTP AUTH protocol for your organization" by navigating to https://admin.exchange.microsoft.com/#/settings

Please validate if security defaults has been disabled in your organization.

If your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings outlined in this article. For more information, see Disable Basic authentication in Exchange Online.

Thanks,

Akshay Kaushik

Please "Accept the answer", "Upvote" and share your feedback (Yes/No) if the suggestion works as per your business need. This will help us and others in the community as well.
Please sign in to rate this answer.
Эдуард Терлецкий 20 Reputation points

2023-02-15T14:08:31.12+00:00

It still doesn't work for me.

The code I'm testing on:

import smtplib import base64 import smtplib from email.mime.multipart import MIMEMultipart from email.mime.text import MIMEText class MicrosoftSMTP(smtplib.SMTP): def __init__(self, host, port, **kwargs): super().__init__(host=host, port=port, **kwargs) @staticmethod def encode_auth_token(username, token): just_a_str = f"user={username}\x01auth=Bearer {token}\x01\x01" xoauth2_token = base64.b64encode(just_a_str.encode()) return xoauth2_token def authenticate(self, username, token): self.helo() # first step, we code, msg = self.docmd("auth", "XOAUTH2") if code != 334: raise Exception(msg.decode()) # send the token self.send(self.encode_auth_token(username, token)) def create_message() -> None: """ Creating messages """ msg = MIMEMultipart("alternative") msg["From"] = "example@email.com" msg["To"] = "example@email.com" msg["Subject"] = "subject" text_part = MIMEText("body", "plain") msg.attach(text_part) return msg app = msal.ConfidentialClientApplication(conf['client_id'], authority=conf['authority'], client_credential=conf['secret']) result = app.acquire_token_silent(conf['scope'], account=None) if not result: print("No suitable token in cache. Get new one.") result = app.acquire_token_for_client(scopes=conf['scope']) if "access_token" in result: print(result['token_type']) else: print(result.get("error")) print(result.get("error_description")) print(result.get("correlation_id")) smtp = MicrosoftSMTP(host="smtp-mail.outlook.com", port=587) smtp.starttls() smtp.authenticate("example@mail.com", result['access_token']) message=create_message() smtp.sendmail("example@email.com", "example@email.com", message.as_string()) smtp.quit()

My settings:

Alex Zonis 70 Reputation points

2023-02-15T19:10:50.7766667+00:00

Hi @Akshay-MSFT ,
The answer to this question resolves the configurations for the work or school accounts. The application I am working with implements the IMAP and SMTP to read and send emails for "common" tenants. I created a new question. I hope you or someone from Microsoft can help me resolve it.

https://learn.microsoft.com/en-us/answers/questions/1181094/535-5-7-3-authentication-unsuccessful-when-using-o

Will Wilding 150 Reputation points

2023-02-16T19:26:27.18+00:00

@Akshay-MSFT

Thank you for the detailed response, but as @Alex Zonis points out, the solution does not assist with outlook.com consumer accounts. I'll edit the question for more clarity.

lubi22 35 Reputation points

2023-02-16T22:14:02.34+00:00

Still not working for me.

@Akshay-MSFT

I am using consumer accounts:
scope=https://outlook.office.com/SMTP.Send%20offline_access" -X POST https://login.microsoftonline.com/common/oauth2/v2.0/devicecode

535 5.7.3 Authentication unsuccessful [SI1PR02CA0035.apcprd02.prod.outlook.com

lubi22 35 Reputation points

2023-02-16T22:17:46.7166667+00:00

It did not refresh, my comment was posted twice. Removing this 2nd one. Thanks.

Эдуард Терлецкий 20 Reputation points

2023-03-07T07:15:30.78+00:00

@Akshay-MSFT any ideas?

Alex Zonis 70 Reputation points

2023-03-07T20:27:29.9633333+00:00

@Akshay-MSFT

Are there any updates? It is still not working. More and more people are facing the same error. Can it be fixed from the Microsoft side?

Will Wilding 150 Reputation points

2023-03-10T21:09:10.3133333+00:00

Also confirmed nothing has changed and it's still broken after over a month now.

Lee Li 0 Reputation points

2023-03-13T08:57:55.2433333+00:00

Hello @Akshay-MSFT @Will Wilding just want to know any update?

HMJ 0 Reputation points

2023-03-29T16:54:08.3+00:00

We are also seeing this exact issue with our consumer facing app. We see the same errors and I am trying to understand why.

IMAP works fine and we see the same error when trying to use SMPT.

Has this been resolved for you?

@Akshay-MSFT @Will Wilding

Cédric Counotte 6 Reputation points

2024-12-27T09:15:06.2133333+00:00

We have used SMTP authentication using secret + refresh token with an app configured in Azure for the past 3 years. The secret expired last week so we created a new one, requested a new refresh token for it and configured the app with those new information.

Now we keep receiving error 535, even though we haven't changed any configuration since last week. Still I verified all the configuration you mentioned and everything checked but security defaults which where on. Disabled them, but still no go.

What else could be going on here? Tried to post a question on this forum but ended with a page not found and lost my 30-minutes edit.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Enzo Tech 0 Reputation points

2023-05-16T07:51:28.07+00:00

Hi all, it seems there was a mystery fix happened on MS side. It is now working. :)
Anyway, due to this issue I was able to produce a Test Tool written in Rust Programming Language just to test this workflow. https://github.com/LorenzoLeonardo/microsoft-smtp-xoauth2-test-tool
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.