The modern IT landscape relies heavily on seamless communication. While we usually think of email as user-to-user messaging via Outlook or a mobile app, a vast ecosystem of applications, devices, and automated services (like scanners, printers, websites, and CRM systems) rely on Simple Mail Transfer Protocol (SMTP) to send automated notifications and reports.
If you are a system administrator, a developer, or just the resident “IT person” tasked with connecting an application (perhaps a web server or an on-premise device) to Microsoft Office 365 for outbound email, you have likely encountered the dreaded message shown on the screen in our accompanying image: “SMTP Configuration Error: Failed to connect to the Office 365 SMTP server. Check settings. Error Code: 0x80040213.” This error often leaves administrators like the one pictured—head in hands, staring at a wall of servers—feeling overwhelmed by configuration complexity.
The migration of infrastructure to the cloud has complicated what used to be a simple username-and-password transaction. Microsoft’s robust security measures, designed to protect billions of mailboxes, mean that “Basic Authentication” is no longer the default, and many legacy devices can no longer connect.
If your SMTP configuration is failing, don’t despair. Here is a comprehensive guide to understanding why it fails and exactly how to fix it.
Step 1: Verify the Core Parameters (The “Table Stakes”)
Before diving into complex authentication scenarios, we must rule out basic configuration typos. The required settings for the Microsoft 365 SMTP submission endpoint are non-negotiable:
- SMTP Server/Host:
smtp.office365.com - Port: 587 (This is the standard port for modern, secure SMTP submission. While port 25 is the classic SMTP port, most modern ISPs and cloud providers, including Microsoft, aggressively block outbound traffic on 25 to mitigate spam.)
- Encryption Method: STARTTLS (must be enabled). This ensures the connection is upgraded to a secure TLS tunnel before any credentials are exchanged.
- Authentication: Requires Authentication (often a checkbox: “My outgoing server requires authentication”).
- Username: This must be the full email address of a licensed Microsoft 365 mailbox (e.g.,
automations@yourdomain.com). - Password: The password associated with that specific mailbox.
Why it fails here: A single typo in smtp.office365.com or selecting “SSL” instead of “STARTTLS” will cause immediate connection failure.
Step 2: The Modern Authentication Problem (The Most Common Cause)
The error message in the image specifically flags “Authentication rejected.” Even if your username and password are correct, and your port is set perfectly, Microsoft 365 might still reject the connection because it does not permit the method of authentication the device is attempting.
Microsoft is aggressively phasing out “Basic Authentication” (simply sending a username and password) in favor of modern authentication protocols like OAuth2. This is the #1 cause of SMTP failure today.
Scenario A: You have MFA (Multi-Factor Authentication) Enabled.
If the mailbox you are using (automations@yourdomain.com) has MFA enabled (which it should), the application cannot possibly handle the second factor (the text message code or the Authenticator app prompt). It sends just the password, and Microsoft 365 rejects it.
- The Fix: You must generate and use an App Password.
- Log into the Microsoft 365 user portal as the automation user.
- Navigate to Security Info > Add Method > App Password.
- Name it (e.g., “Printer SMTP”).
- Copy the long, complex generated password and use that as the password in your SMTP configuration. This bypasses the MFA challenge for that specific application.
Scenario B: “Security Defaults” are Enabled in your Tenant.
If your tenant is new or you have enabled “Security Defaults,” Microsoft automatically blocks all legacy authentication protocols, including SMTP AUTH (Basic Auth). An App Password will not work here.
- The Fix: You must explicitly enable SMTP AUTH for that single mailbox, even if Security Defaults are on.
- Go to the Microsoft 365 Admin Center (
admin.microsoft.com). - Users > Active Users > Select the specific mailbox (e.g.,
automations). - Go to the Mail tab.
- Under “Email apps,” click Manage email apps.
- Check the box for Authenticated SMTP and save changes.
- Go to the Microsoft 365 Admin Center (
Scenario C: Modern OAuth2 is Required (High Security).
For highly secure environments or application development, Microsoft recommends or requires OAuth2.
- The Fix: Your application or device must support modern authentication (OAuth2). In the configuration, instead of simple user/pass, you must provide a Client ID, Client Secret, and Tenant ID from an app registration you created in Microsoft Entra ID (formerly Azure AD). This requires development effort or modern application support.
Step 3: Check TLS Versions and Port Blocking
Security is not just about authentication; it’s also about the cryptographic protocols in use. Microsoft 365 has retired support for older, insecure encryption methods (TLS 1.0 and 1.1).
TLS Version Mismatch
If you are using a device (like an old scanner or a 10-year-old server) that only supports TLS 1.0 or TLS 1.1, the smtp.office365.com server will terminate the connection immediately during the STARTTLS negotiation.
- The Fix:
- Upgrade the firmware on the legacy device (this often adds TLS 1.2 support).
- If the device cannot be upgraded, you must set up an SMTP Relay (a local IIS server or a third-party service like SendGrid) that does support TLS 1.2 and can accept the local device’s connection on TLS 1.0, and then relay the message to Microsoft 365 securely.
Network and ISP Restrictions
Even if your configuration is perfect, the network environment might be hostile to SMTP.
- The Fix: Confirm your internal network allows outbound traffic on Port 587. Many corporate firewalls default to blocking all non-essential ports. If you are configuring a device at a remote location (a small branch office or a home), check if the local ISP blocks Port 587, which some consumer ISPs do to fight malware.
Summary Checklist for SMTP Success
If you are facing the failure shown in the image, follow this sequential check:
- Correct Host/Port: Verify
smtp.office365.comand Port 587. - STARTTLS Enabled: Confirm encryption is set to STARTTLS.
- Authentication Required: Ensure the “requires authentication” box is checked.
- Try an App Password: If MFA is enabled on the mailbox, generate and use an App Password.
- Enable SMTP AUTH in Admin Center: Go to Admin Center > Mailbox Properties > Email Apps and activate “Authenticated SMTP.”
- Validate TLS 1.2: Confirm the device supports and is configured for TLS 1.2.
Also Read: Office 365 SMTP Relay Not Working
Source: How to Resolve SMTP Email Sending Issues with Office 365 – CodingTechRoom