535 5.7.139 SmtpClientAuthentication is disabled: fix

The errors and what they mean

Error	What it means
`535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant`	SMTP AUTH is off for your whole organization. The same text ending in “for the Mailbox” means it’s off for that one mailbox.
`535 5.7.3 Authentication unsuccessful`	The login failed. The password may be wrong, but often SMTP AUTH is off, or MFA, security defaults or a Conditional Access policy blocks password sign-in.
`5.7.57 Client not authenticated to send mail`	The app connected to `smtp.office365.com` without logging in. Add the mailbox’s username and password.
`5.7.60 SMTP; Client does not have permissions to send as this sender`	The From address isn’t the mailbox you signed in with, and that mailbox has no Send As permission for it.
`554 5.2.0 STOREDRV.Submission.Exception:SendAsDeniedException`	The same Send As problem, reported when the message is submitted.
`550 5.1.8 Bad outbound sender`	Microsoft blocked the mailbox for sending spam. An admin can release it from the Restricted users portal.

Why SMTP AUTH is off

Microsoft’s own guidance is to disable SMTP AUTH for the organization and enable it only for mailboxes that need it. Several things switch it off:

New organizations: Microsoft says SMTP AUTH is disabled for organizations created after January 2020.
Security defaults in Microsoft Entra ID: when they’re on, SMTP AUTH is already disabled.
An authentication policy that blocks Basic authentication for SMTP, or a Conditional Access policy that blocks legacy authentication. Either one wins even if the mailbox setting is on.
The organization switch SmtpClientAuthenticationDisabled set to True.

1Turn on Authenticated SMTP for the mailbox

Use a dedicated mailbox such as website@yourdomain.com. In the Microsoft 365 admin center:

Go to Users → Active users and select the user.
Open the Mail tab, then Manage email apps.
Tick Authenticated SMTP and select Save changes.

The mailbox setting overrides the organization setting, so this works even when SMTP AUTH is off for everyone else.

2Or do it in PowerShell

Exchange Online PowerShell does the same thing and lets you check the current value:

powershell

# Install-Module ExchangeOnlineManagement   (once)
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

# Is SMTP AUTH off for this mailbox? True = off, False = on, blank = follows the organization
Get-CASMailbox -Identity website@yourdomain.com | Format-List SmtpClientAuthenticationDisabled

# Turn it on for this one mailbox (overrides the organization setting)
Set-CASMailbox -Identity website@yourdomain.com -SmtpClientAuthenticationDisabled $false

# The organization-wide switch, for reference: True = off for everyone
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

3Check security defaults and Conditional Access

If the error continues, Microsoft’s troubleshooting article lists these checks, in this order:

Multifactor authentication on the mailbox blocks password sign-in over SMTP.
Security defaults: Microsoft Entra ID → Properties → Manage security defaults. Microsoft warns not to switch them off unless you understand the risks.
Conditional Access: exclude the mailbox from any policy that blocks legacy authentication.

These are organization-wide security decisions. A dedicated, licensed mailbox with a long random password, used only for sending, keeps the exception small.

4Use the settings Microsoft documents

Host	`smtp.office365.com` (the name, not an IP address)
Port	`587` with STARTTLS (SSL off in most apps)
TLS	TLS 1.2 or 1.3
Username	The mailbox’s full email address
Password	The mailbox password
From address	The same mailbox, or one it has Send As permission for

Don’t use port 465 here. Microsoft notes that a device or app that defaults to 465 doesn’t support the TLS that client submission requires. Microsoft also limits this method to 10,000 recipients a day and 30 messages a minute.

Fix 5.7.60 and SendAsDenied

Set the From address to the mailbox you sign in with. If you need to send as another address (say sales@ while signing in as website@), an admin must give the sign-in mailbox Send As permission on it.

Microsoft’s SMTP AUTH timeline

Microsoft is retiring Basic authentication (username and password) for SMTP AUTH. Its current plan, from the Exchange Team blog post of January 27, 2026 (updated January 29), replaces the earlier March–April 2026 dates:

When	What Microsoft says happens
Now to December 2026	SMTP AUTH Basic Authentication behavior remains unchanged.
End of December 2026	SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed.
New tenants created after December 2026	SMTP AUTH Basic Authentication will be unavailable by default. OAuth will be the supported authentication method.
Second half of 2027	Microsoft will announce the final removal date for SMTP AUTH Basic Authentication.

We found no newer post on the Exchange Team blog as of November 2, 2026. In practice, expect 5.7.139 errors to appear in January 2027 in tenants where nobody has turned SMTP AUTH on, and plan to move off password SMTP before the final date. Microsoft’s suggested replacements are OAuth for SMTP AUTH, High Volume Email (internal recipients only) and Azure Communication Services Email.

Outlook.com and Hotmail accounts

None of the above applies to personal accounts, and there’s no switch to flip. Microsoft says Basic authentication has been unavailable for every Outlook account since September 16, 2024, and its Outlook.com settings page says “Outlook.com requires the use of Modern Auth / OAuth2”. Any tool that signs in to smtp-mail.outlook.com with a password will fail, whatever the password. The Outlook & Microsoft 365 guide covers the alternatives.

Using FormSMTP? FormSMTP signs in to SMTP with a username and password. It works with a Microsoft 365 mailbox while Authenticated SMTP is on for it, and Test connection shows Microsoft’s exact reply, so you can confirm the steps above worked. It can’t use Outlook.com or Hotmail addresses. For anything long-lived, connect a sending service with your domain verified (SES, Brevo, Resend). Microsoft’s retirement doesn’t affect those. Start free.

More codes: the SMTP error code reference. Settings for every provider: SMTP settings.

Sources

Checked on the vendors’ own pages on November 2, 2026.

FAQ

How do I fix “SmtpClientAuthentication is disabled for the Tenant”?

An admin turns on Authenticated SMTP for the sending mailbox (Microsoft 365 admin center → Users → Active users → Mail → Manage email apps), or runs Set-CASMailbox -Identity mailbox -SmtpClientAuthenticationDisabled $false. The mailbox setting overrides the tenant setting.

I enabled Authenticated SMTP and still get 535 5.7.3. Why?

Something else blocks password sign-in: security defaults, an authentication policy that disables Basic auth for SMTP, a Conditional Access policy blocking legacy authentication, or MFA on the mailbox.

When does Microsoft turn off SMTP AUTH with a password?

Microsoft says it will be disabled by default for existing tenants at the end of December 2026, with admins still able to enable it. Tenants created after December 2026 won’t have it by default. The final removal date will be announced in the second half of 2027.

Can I use smtp-mail.outlook.com with my Hotmail password?

No. Since September 16, 2024, personal Outlook accounts only accept OAuth (Modern Auth), so password-based SMTP fails.

Should I use port 587 or 465 for Microsoft 365?

Port 587 with STARTTLS. Microsoft documents 587 (or 25) for client submission and says a device that defaults to 465 doesn’t support the TLS it requires.