Outlook & Microsoft 365 SMTP Setup (2026 App Password Guide)

Microsoft considers SMTP AUTH a legacy protocol because it can't enforce MFA on the connection itself. They recommend OAuth 2.0 or Microsoft Graph for new applications. SMTP AUTH still works fine — they've just stopped enabling it by default for new tenants and might fully sunset it in the future. Plan accordingly if you're building something long-lived.

Both still resolve, but smtp.office365.com is the modern endpoint for both personal Outlook.com and Microsoft 365 accounts. Microsoft has unified these — use smtp.office365.com everywhere.

Yes, but you authenticate with your own credentials. Grant your user "Send As" permission on the shared mailbox in Exchange admin, then set the From header to the shared address while authenticating as yourself.

Re-enabling SMTP AUTH lowers your tenant's Secure Score because Microsoft views it as a legacy protocol. Re-enable it only for the user accounts that need it, not tenant-wide, and monitor sign-in logs for suspicious activity.

Yes — Microsoft 365 signs all outbound mail with DKIM using their selectors, but if you want stronger deliverability, set up a custom DKIM key under Microsoft Defender → Email & collaboration → Policies → DKIM. Pair with an SPF record (v=spf1 include:spf.protection.outlook.com -all) and a DMARC policy.

Authentication and deliverability are different problems. Successful SMTP delivery just means Microsoft accepted the message — placement depends on sender reputation, SPF/DKIM alignment, content, and recipient interaction. Set up DMARC, warm up the address, and avoid spammy phrases.