Outlook SMTP settings: smtp.office365.com, port 587

Microsoft removed Basic Authentication from most Exchange Online protocols on October 1, 2022, and SMTP client submission is the last protocol still accepting it. Microsoft plans to disable Basic auth for SMTP AUTH by default at the end of December 2026. The server is still smtp.office365.com on port 587 with STARTTLS, but new integrations should authenticate with an OAuth 2.0 token in XOAUTH2 format. Here’s the full reference.

Sending from an app on behalf of Outlook users? The Nylas Email API skips SMTP entirely. Microsoft 365 and Outlook.com accounts connected with a Microsoft grant send through Microsoft Graph with OAuth, so there’s no SMTP server, port, SMTP AUTH setting, or XOAUTH2 string to manage. The settings below are for integrations that talk to Exchange Online over SMTP directly. The send Outlook email recipe shows the API path.

What are the Outlook SMTP server settings?

The Outlook SMTP server is smtp.office365.com for Microsoft 365 work and school accounts and smtp-mail.outlook.com for personal Outlook.com accounts, both on port 587 with STARTTLS. Microsoft’s client SMTP submission settings list port 587 as recommended and require TLS 1.2 or TLS 1.3. The username is the full email address.

Don’t use port 465 with Microsoft 365. Microsoft says a device or application that recommends or defaults to TCP port 465 “doesn’t support the required versions of TLS for client SMTP submission”. The same settings table lists port 25 as the only alternative to 587.

Setting	Value
SMTP server (Microsoft 365 / Exchange Online)	smtp.office365.com
SMTP server (Outlook.com personal accounts)	smtp-mail.outlook.com
Port	587
Encryption	STARTTLS (required)
Authentication	OAuth 2.0 (Modern Auth)
Username	Full email address
IMAP server	outlook.office365.com (port 993, TLS)
POP3 server	outlook.office365.com (port 995, TLS)

Two details catch developers. First, the IMAP and POP3 hostname (outlook.office365.com) differs from the SMTP hostname, so copying one into the other field fails. Second, SMTP AUTH can be switched off for the whole organization or for individual mailboxes, and it’s already off in tenants that use Entra ID security defaults. Microsoft’s SMTP AUTH documentation shows how an admin checks and changes the setting with Set-CASMailbox -SmtpClientAuthenticationDisabled.

smtp-mail.outlook.com vs smtp.office365.com: which should you use?

Use smtp-mail.outlook.com for personal Microsoft accounts on Outlook.com, such as @outlook.com and @hotmail.com addresses, and smtp.office365.com for mailboxes hosted in Microsoft 365 or Exchange Online. The 2 hostnames share port 587, STARTTLS, and OAuth 2.0, so choose the hostname by account type: personal or work.

	smtp-mail.outlook.com	smtp.office365.com
Account type	Personal Outlook.com accounts	Microsoft 365 / Exchange Online work and school accounts
Port	587	587 (recommended) or 25
Encryption	STARTTLS	STARTTLS with TLS 1.2 or TLS 1.3
Authentication	OAuth2 / Modern Auth	OAuth 2.0 (XOAUTH2); Microsoft is retiring Basic auth
Microsoft source	Outlook.com POP, IMAP, and SMTP settings	Client SMTP submission for Microsoft 365

Microsoft’s Outlook.com article lists smtp-mail.outlook.com on port 587 with STARTTLS and says “Outlook.com requires the use of Modern Auth / OAuth2.” If you connect accounts through a Microsoft grant on Nylas, neither hostname applies: mail goes out through Microsoft Graph with the Mail.ReadWrite and Mail.Send scopes.

How did the Basic Auth shutdown change SMTP access?

Microsoft disabled Basic Authentication for most Exchange Online protocols, including POP, IMAP, EWS, Exchange ActiveSync, and Remote PowerShell, starting October 1, 2022. SMTP AUTH got an exception that Microsoft has extended several times. The current plan, published in the updated SMTP AUTH deprecation timeline, disables Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026, lets tenant admins re-enable it, and says Microsoft will announce the final removal date in the second half of 2027. For tenants created after December 2026, Basic auth for SMTP AUTH is unavailable by default and OAuth is the supported method, so new integrations should present an OAuth 2.0 access token using the XOAUTH2 SASL mechanism from the start.

Modern Auth SMTP needs an Entra ID (Azure AD) app registration with the SMTP.Send delegated permission. The token request goes to https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token with scope=https://outlook.office.com/SMTP.Send (add offline_access for refresh tokens); app-only flows authorized by a tenant admin use scope=https://outlook.office365.com/.default instead. Microsoft access tokens last a random 60 to 90 minutes by default, so production code needs a refresh loop. A Microsoft grant on Nylas skips all of this, because the API stores the refresh token and renews access tokens for you. For direct SMTP, the handshake looks like this:

EHLO client.example.com
STARTTLS
EHLO client.example.com
AUTH XOAUTH2 <base64-encoded-token-string>

# Token string format before base64 encoding:
# [email protected]^Aauth=Bearer <access_token>^A^A
# where ^A is the ASCII SOH character (0x01)

The XOAUTH2 string isn’t a standard Bearer header: the user= and auth=Bearer fields are separated by SOH (0x01) characters before the whole string is base64-encoded. A malformed string fails authentication. Microsoft’s XOAUTH2 documentation includes a sample that builds the string correctly.

What are common Outlook SMTP errors and fixes?

Outlook SMTP returns RFC 5321 reply codes with Microsoft-specific enhanced status codes. The throttling and quota errors below come from Microsoft’s documentation for SMTP AUTH submissions:

Error	Meaning	Fix
432 4.3.2 Concurrent connections limit exceeded	More than 3 connections are submitting messages for the mailbox at once	Send over fewer parallel connections, then retry
554 5.2.0 Submission quota exceeded (SubmissionQuotaExceededException)	The mailbox passed its daily limit of 10,000 recipients	Wait for the 24-hour window to roll forward, or spread sending across mailboxes
554 5.2.2 Mailbox full	The sending mailbox is full, so it can’t save to Sent Items	Free space, or set a retention policy on Sent Items
550 5.2.251 to 550 5.2.255	The mailbox is throttled after repeated errors: mailbox full, Send As denied, invalid license, too many recipients, or invalid recipients	Fix the underlying error, then wait for the throttling period to end

Microsoft documents the first three in message storage and concurrent connection throttling for SMTP AUTH, and the 5.2.25x family in continuous error throttling for SMTP AUTH. Microsoft sets the throttling period for the 5.2.25x errors, and Microsoft support can’t lift it.

Authentication failures, such as 535 5.7.3 Authentication unsuccessful, usually mean one of three things: SMTP AUTH is turned off for the mailbox or organization, the client sent a username and password where Basic auth is disabled, or the XOAUTH2 string is malformed. Check the SMTP AUTH setting first, then the token request and the SOH-separated encoding shown above. For other delivery errors, see Microsoft’s list of Exchange Online NDR and SMTP error codes.

What are the sending limits for Microsoft 365?

Microsoft 365 applies these limits to each mailbox: 30 messages per minute and 10,000 recipients per 24 hours. Microsoft’s Exchange Online limits page applies them “per user to all outbound and internal messages”. For SMTP AUTH, Microsoft says messages over the per-minute rate are throttled and carried over into the following minutes, which shows up as delayed delivery. Going over the daily recipient limit returns the 554 5.2.0 error above.

Limit	Microsoft 365	Outlook.com (Microsoft 365 subscribers)
Recipients per day	10,000	5,000
Recipients per message	500 by default; admins can set 1 to 1,000	500
New or external recipients per day	A tenant-wide external recipient limit, sized by license count	1,000 recipients never emailed before
Messages per minute	30	Not published
Max message size	35 MB by default; admins can set 1 MB to 150 MB	Not published

Microsoft sets the 500-recipient default in its customizable recipient limits announcement. The Outlook.com figures come from Sending limits in Outlook.com, which counts a new recipient as someone the account has never emailed before. Microsoft says limits “will be lower for non-subscribers” and starts new accounts on a low temporary quota, without publishing those numbers.

The 30-messages-per-minute cap surprises teams building notification systems, because it’s per mailbox rather than per tenant. For bulk or high-volume email to external recipients, Microsoft’s Exchange Online limits recommend Azure Communication Services Email rather than a user mailbox.

How do you send Outlook email without SMTP?

The Nylas Email API sends through a connected Outlook or Microsoft 365 account with one HTTPS request: POST /v3/grants/{grant_id}/messages/send. The grant authenticates through Microsoft Graph with the Mail.ReadWrite and Mail.Send scopes, so SMTP AUTH never enters the picture, and the 2026 Basic auth retirement doesn’t affect it. There’s no XOAUTH2 encoding and no per-mailbox SMTP AUTH setting.

The samples below send one message from a connected account. The same request body works for Microsoft 365, Outlook.com, Exchange, Gmail, Yahoo, iCloud, and IMAP accounts, so one code path covers every provider. The curl request also turns on open, link, and reply tracking, and the Python sample attaches a file.

RequestNode.js SDKPython SDK

curl --request POST \
  --url 'https://api.us.nylas.com/v3/grants/<NYLAS_GRANT_ID>/messages/send' \
  --header 'Authorization: Bearer <NYLAS_API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "subject": "Reaching Out with Nylas",
    "body": "Reaching out using the <a href='https://www.nylas.com/products/email-api/'>Nylas Email API</a>",
    "to": [{
      "name": "Leyah Miller",
      "email": "[email protected]"
    }],
    "tracking_options": {
      "opens": true,
      "links": true,
      "thread_replies": true,
      "label": "hey just testing"
    }
  }'

import Nylas from "nylas";

const nylas = new Nylas({
  apiKey: "<NYLAS_API_KEY>",
  apiUri: "<NYLAS_API_URI>",
});

async function sendEmail() {
  try {
    const sentMessage = await nylas.messages.send({
      identifier: "<NYLAS_GRANT_ID>",
      requestBody: {
        to: [{ name: "Name", email: "<EMAIL>" }],
        replyTo: [{ name: "Name", email: "<EMAIL>" }],
        replyToMessageId: "<MESSAGE_ID>",
        subject: "Your Subject Here",
        body: "Your email body here.",
      },
    });

    console.log("Sent message:", sentMessage);
  } catch (error) {
    console.error("Error sending email:", error);
  }
}

sendEmail();

import os
import sys
from nylas import Client
from nylas import utils

nylas = Client(
    "<NYLAS_API_KEY>",
    "<NYLAS_API_URI>"
)

grant_id = "<NYLAS_GRANT_ID>"
email = "<EMAIL>"

attachment = utils.file_utils.attach_file_request_builder("Nylas_Logo.png")

message = nylas.messages.send(
  grant_id,
  request_body={
    "to": [{ "name": "Name", "email": email }],
    "reply_to": [{ "name": "Name", "email": email }],
    "reply_to_message_id": "<MESSAGE_ID>",
    "subject": "Your Subject Here",
    "body": "Your email body here.",
    "attachments": [attachment]
  }
)

print(message)

Here’s what the API takes off your plate compared with SMTP AUTH:

• Token lifecycle. Microsoft access tokens last 60 to 90 minutes. The grant keeps the refresh token, and the API renews access tokens for you, so there’s no Entra ID token loop in your code.
• Safe retries. An Idempotency-Key header lets you retry a send without delivering a duplicate. See idempotent send requests.
• Throttling. A throttled send returns a 429 right away. Wait the number of seconds in Retry-After when the response includes it, and send to each grant one message at a time.
• Delivery outcome. The message.send_success, message.send_failed, and message.bounce_detected webhooks report what happened after the request, described in Sending messages with Nylas.

Microsoft’s sending limits above still apply, because mail leaves through the user’s mailbox. If you control a single tenant and only need a device or script to send mail, SMTP AUTH with OAuth remains a valid option. The send Outlook email recipe compares the API with Microsoft Graph’s sendMail endpoint, and send email without SMTP covers the provider-neutral version.

What’s next

• Quickstart: Email API connects a Microsoft account and makes a first API call in under 5 minutes.
• How to send Outlook email sends through Microsoft 365 with one API call.
• Gmail SMTP settings is the Google equivalent of this reference.
• Send email without SMTP covers the cross-provider API path.
• How to list Microsoft email messages reads the mailbox the same connection sends from.