Office 365 SMTP Settings for Cold Email Tools (2026 Guide)

Office 365 SMTP settings look simple: smtp.office365.com, port 587, STARTTLS. Then you connect your fifth inbox to a cold email tool and hit 535 5.7.139 Authentication unsuccessful.

This guide gives the exact Microsoft 365 SMTP and IMAP settings and shows how to enable SMTP AUTH for one inbox or fifty. It then walks through connecting Instantly, Smartlead, and other sequencers, with a fix for every common auth error.

Every setting comes from Microsoft Learn and the Exchange team blog, checked October 2026. It also covers the December 2026 Basic auth change, which most settings guides still miss.

TL;DR: Office 365 SMTP Settings

• SMTP: smtp.office365.com, port 587, STARTTLS with TLS 1.2 or later. The username is the full email address.
• IMAP: outlook.office365.com, port 993, SSL/TLS. POP uses the same server on port 995.
• Port 465 is not supported for Microsoft 365 client submission.
• SMTP AUTH is off by default in tenants created after January 2020. Turn it on per inbox in the Microsoft 365 admin center or with Set-CASMailbox.
• Connect with OAuth (Sign in with Microsoft). App passwords do not work for IMAP, so they cannot power a cold email tool.
• Basic auth for SMTP AUTH becomes disabled by default at the end of December 2026. OAuth connections are not affected.
• Volume: Microsoft allows 10,000 recipients a day per mailbox, but cold email inboxes should stay at 30 to 50 sends a day.

Office 365 SMTP, IMAP and POP Settings

The Office 365 SMTP server is smtp.office365.com on port 587 with STARTTLS, and the IMAP server is outlook.office365.com on port 993 with SSL/TLS. These values are the same for every Microsoft 365 business plan, from Business Basic to E5.

Always enter the hostname, never an IP address. Microsoft rotates the IPs behind smtp.office365.com, so a hard-coded IP breaks without warning.

Microsoft documents these values in its guide to sending email from a device or application with Microsoft 365. SMTP AUTH client submission is the option every cold email tool uses.

Personal Outlook.com accounts are different

Personal Outlook.com and Hotmail accounts use smtp-mail.outlook.com on port 587 and imap-mail.outlook.com on port 993. They are consumer inboxes, so keep them out of cold email entirely.

Why Port 465 Does Not Work

Port 465 appears in many Office 365 SMTP guides, but Microsoft 365 does not accept client submission on it. Microsoft’s own documentation says that if a device recommends or defaults to port 465, it does not support the required TLS versions.

If a tool offers SSL on 465 or STARTTLS on 587, pick 587 with STARTTLS. Port 25 also works for SMTP AUTH, but many ISPs and cloud hosts block outbound traffic on 25.

How to Enable SMTP AUTH in Microsoft 365

To enable SMTP AUTH, tick Authenticated SMTP for the mailbox in the Microsoft 365 admin center or set SmtpClientAuthenticationDisabled to $false in Exchange Online PowerShell. Microsoft disables it by default for tenants created after January 2020, which is why fresh inboxes fail on the first connect.

The setting exists at two levels, and the mailbox setting overrides the tenant setting. So you can keep SMTP AUTH off org-wide and switch it on only for sending inboxes, as Microsoft recommends.

Option 1: Microsoft 365 admin center (one inbox)

1. Sign in to the Microsoft 365 admin center as a Global or Exchange admin.
2. Go to Users > Active users and select the sending inbox.
3. Open the Mail tab and click Manage email apps.
4. Tick Authenticated SMTP and IMAP, then click Save changes.

Give the change time to apply before you connect the inbox. Smartlead’s docs suggest waiting 20 to 30 minutes, and Instantly suggests about an hour.

Option 2: PowerShell (one inbox)

Install the ExchangeOnlineManagement module, connect, then run Set-CASMailbox. The final line confirms the value now reads False.

# One-time setup
Install-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

# Enable SMTP AUTH and IMAP for one sending inbox
Set-CASMailbox -Identity sender@yourdomain.com -SmtpClientAuthenticationDisabled $false -ImapEnabled $true

# Verify (should return False)
Get-CASMailbox -Identity sender@yourdomain.com | Format-List SmtpClientAuthenticationDisabled

Option 3: PowerShell (bulk, for 10+ inboxes)

Put one email address per line in a text file, then loop through it. This is the fastest way to prep a new batch of sending inboxes.

# inboxes.txt holds one email address per line
$Allow = Get-Content "inboxes.txt"
$Allow | foreach { Set-CASMailbox -Identity $_ -SmtpClientAuthenticationDisabled $false -ImapEnabled $true }

Option 4: Tenant-wide

In the Exchange admin center, go to Settings > Mail flow and clear Turn off SMTP AUTH protocol for your organization. The PowerShell equivalent is below.

# Enable SMTP AUTH for the whole organization
Set-TransportConfig -SmtpClientAuthenticationDisabled $false

# Reset one mailbox to follow the org setting again
Set-CASMailbox -Identity sender@yourdomain.com -SmtpClientAuthenticationDisabled $null

Tenant-wide is simpler, but per-mailbox is safer. Every inbox with SMTP AUTH on is one more target for password spraying, so enable only the inboxes that send.

Security Defaults and Conditional Access

Two Entra ID settings can block SMTP AUTH even after you enable it. Both usually return 535 5.7.139 with a message that the request did not meet the criteria to be authenticated.

• Security defaults block legacy authentication, which includes Basic-auth SMTP AUTH, IMAP, and POP. Check them under Entra admin center > Identity > Overview > Properties > Manage security defaults.
• Conditional Access policies that block legacy authentication or require compliant devices can reject the sign-in. Exclude the sending inboxes or allow the cold email app, rather than turning the policy off.

Microsoft explains the tradeoffs in its security defaults guide. OAuth sign-ins are modern authentication, so if one still fails, look for a Conditional Access policy that targets the app.

OAuth vs App Passwords (and the 2026 Change)

Cold email tools must connect Microsoft 365 inboxes with OAuth, because IMAP no longer accepts passwords. Microsoft removed Basic authentication for IMAP, POP, EWS, and ActiveSync in Exchange Online starting October 1, 2022, and it cannot be turned back on.

Microsoft also notes that the change stops app passwords from working with apps that do not support two-step verification. A sequencer needs IMAP to read replies and run warmup, so an app password alone leaves it half-broken.

The SMTP AUTH Basic auth timeline

SMTP AUTH is the last protocol where a password still works. The Exchange team’s January 2026 update sets this schedule.

A rejected Basic login returns 550 5.7.30 Basic authentication is not supported for Client Submission. OAuth connections from Instantly, Smartlead, and similar tools keep working through every stage.

When an app password still helps

App passwords only exist when legacy per-user MFA is on and an admin has allowed them in the MFA service settings. Users then create them on their Security info page, up to 40 per account, per Microsoft’s app password docs.

They can sign a send-only script into Basic SMTP AUTH until it is retired. Treat that as a stopgap for a printer or a cron job, not a cold email setup.

Connect Office 365 to Instantly

Instantly connects Microsoft 365 inboxes with OAuth, so you never paste an SMTP password. Enable Authenticated SMTP and IMAP for the inbox first, using any option above.

1. In Instantly, open Email Accounts and click Add or Buy Accounts.
2. Choose Connect existing accounts, then Office 365 / Outlook.
3. Confirm with Yes, the SMTP has been enabled.
4. Sign in with the Microsoft account. Pick Use another account if your browser is signed in as someone else.
5. If you are the admin, tick Consent on behalf of your organization and accept.
6. Turn on warmup and add a custom tracking domain before the first campaign.

For plan limits and warmup details, read our Instantly review. Once inboxes are live, the SyncGTM Instantly integration pushes enriched, verified leads straight into campaigns.

Connect Office 365 to Smartlead

Smartlead also uses Microsoft OAuth for Outlook inboxes. Enable Authenticated SMTP and IMAP, then wait 20 to 30 minutes before connecting.

1. In Smartlead, go to Email Accounts and click + Connect Mailbox.
2. Pick Smartlead’s Infrastructure, then Outlook.
3. Sign in with the Microsoft account and click Accept on the permissions screen.
4. Wait for the status to turn green and read Connected.

Outlook inboxes connect one at a time, because each needs its own OAuth sign-in; there is no CSV bulk import for them. Teams that run their own Azure app can use the private infrastructure option, which needs an admin to click Grant admin consent in Entra.

If a mailbox disconnects, remove and reconnect it to refresh the token. Our Smartlead review and Smartlead vs Instantly comparison cover which sender fits your volume, and the SyncGTM Smartlead integration feeds it clean leads.

Other Sequencers: Manual SMTP and IMAP

Most modern sequencers offer a Microsoft or Outlook sign-in button. Use it over the generic SMTP/IMAP form whenever it exists.

If a tool only offers a manual form, enter these values:

• SMTP host: smtp.office365.com, port 587, security STARTTLS (sometimes labelled TLS).
• IMAP host: outlook.office365.com, port 993, security SSL/TLS.
• Username: the full email address, for both SMTP and IMAP.
• From address: the same mailbox, unless you have granted Send As permission on another address.

Expect the IMAP half to fail, because Microsoft no longer accepts passwords for IMAP. A tool without Microsoft OAuth can only send, and after December 2026 even that needs an admin to keep Basic SMTP AUTH switched on.

Sending Limits vs Safe Cold Email Volume

A Microsoft 365 mailbox can send to 10,000 recipients a day at 30 messages a minute, but cold email inboxes should stay at 30 to 50 sends a day. The Exchange Online limits are ceilings for normal business mail, not targets for outreach.

Inboxes that run near the ceilings get throttled, flagged, or restricted from sending. To reach 1,500 sends a day, plan for 30 to 50 warmed inboxes across several domains, not three inboxes at 500 each.

Our domain warm-up guide covers the ramp schedule, and the best cold email warm-up tools compares the services that automate it.

Office 365 SMTP Errors and Fixes

Most Office 365 SMTP errors are authentication problems, not server settings. Match the code your tool shows to the row below.

One error deserves extra care: a 550 5.1.8 means Microsoft already treats the inbox as a spam source. Releasing it without fixing bounces and volume just restarts the clock.

Bounce-driven blocks often start as soft bounces. Our guide to soft bounce emails explains how to spot them before they escalate.

How to Test the Connection

Before blaming the tool, confirm your network can reach Microsoft on port 587. A 220 banner or TcpTestSucceeded : True means the port is open.

# Windows PowerShell: expect TcpTestSucceeded : True
Test-NetConnection smtp.office365.com -Port 587

# macOS or Linux: expect the certificate chain, then a 250 reply to EHLO
openssl s_client -starttls smtp -connect smtp.office365.com:587 -crlf

# Classic check: expect a 220 banner from Microsoft
telnet smtp.office365.com 587

If the port test passes but login fails, the problem is authentication, not networking. Go back to the error table and check SMTP AUTH, security defaults, and Conditional Access in that order.

SPF, DKIM and DMARC for Microsoft 365

Correct SMTP settings get mail out the door, and DNS authentication decides whether it reaches the inbox. Every sending domain on Microsoft 365 needs all three records.

SPF    TXT    @                      v=spf1 include:spf.protection.outlook.com -all
DKIM   CNAME  selector1._domainkey   <value shown in the Microsoft Defender portal>
DKIM   CNAME  selector2._domainkey   <value shown in the Microsoft Defender portal>
DMARC  TXT    _dmarc                 v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

• SPF: publish one SPF record per domain with include:spf.protection.outlook.com, as Microsoft’s SPF guide shows. Merge includes if other services send for the same domain.
• DKIM:enable it in the Microsoft Defender portal under Email & collaboration > Policies & rules > Threat policies > Email authentication settings. Publish both CNAME records it shows, then switch signing on.
• DMARC: start at p=none to collect reports, then move to quarantine once SPF and DKIM pass.

For the full setup and ramp plan, see our email domain warmup guide. To confirm where mail lands, use one of the best inbox placement testing tools.

Protect Your Tenant With Clean Lists

High bounce rates are one of the fastest ways to get a Microsoft 365 inbox flagged as a spam source. Once an inbox lands on the Restricted entities list, an admin must release it, and the domain reputation damage lingers.

SyncGTM verifies every address before it reaches your sequencer. Email verification costs 0.1 credits per address, and finding a work email costs 1 credit, with no charge when nothing is found.

Lookups run through a waterfall of 50+ data providers, then clean leads sync into Instantly, Smartlead, or your CRM. See SyncGTM pricing for credit packs.

Conclusion

The core Office 365 SMTP settings fit on one line: smtp.office365.com, port 587, STARTTLS, and the full email address as username. Most failures come from what surrounds them: SMTP AUTH switched off, security policies, and Basic auth.

Enable Authenticated SMTP and IMAP per inbox, connect through OAuth, and keep each inbox at 30 to 50 sends a day. Do that now and the December 2026 change will not touch your sending.

Then keep every list clean with SyncGTM so your Microsoft inboxes stay off the Restricted entities list.