# 535 5.7.139 SmtpClientAuthentication is disabled: fix

> Fix Microsoft 365 “535 5.7.139 SmtpClientAuthentication is disabled for the Tenant”, 5.7.3 and 5.7.60 errors, plus Microsoft’s SMTP AUTH retirement timeline.

Source: https://formsmtp.com/guides/microsoft-365-smtp-auth-disabled · Last updated November 2, 2026

## The errors and what they mean

| Error | What it means |
| --- | --- |
| `535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant` | SMTP AUTH is off for your whole organization. The same text ending in “for the Mailbox” means it’s off for that one mailbox. |
| `535 5.7.3 Authentication unsuccessful` | The login failed. The password may be wrong, but often SMTP AUTH is off, or MFA, security defaults or a Conditional Access policy blocks password sign-in. |
| `5.7.57 Client not authenticated to send mail` | The app connected to `smtp.office365.com` without logging in. Add the mailbox’s username and password. |
| `5.7.60 SMTP; Client does not have permissions to send as this sender` | The From address isn’t the mailbox you signed in with, and that mailbox has no **Send As** permission for it. |
| `554 5.2.0 STOREDRV.Submission.Exception:SendAsDeniedException` | The same Send As problem, reported when the message is submitted. |
| `550 5.1.8 Bad outbound sender` | Microsoft blocked the mailbox for sending spam. An admin can release it from the Restricted users portal. |

## Why SMTP AUTH is off

Microsoft’s own guidance is to disable SMTP AUTH for the organization and enable it only for mailboxes that need it. Several things switch it off:

- **New organizations:** Microsoft says SMTP AUTH is disabled for organizations created after January 2020.
- **Security defaults** in Microsoft Entra ID: when they’re on, SMTP AUTH is already disabled.
- **An authentication policy** that blocks Basic authentication for SMTP, or a **Conditional Access** policy that blocks legacy authentication. Either one wins even if the mailbox setting is on.
- **The organization switch** `SmtpClientAuthenticationDisabled` set to `True`.

## 1. Turn on Authenticated SMTP for the mailbox

Use a dedicated mailbox such as `website@yourdomain.com`. In the [Microsoft 365 admin center](https://admin.microsoft.com):

1. Go to *Users → Active users* and select the user.
2. Open the *Mail* tab, then *Manage email apps*.
3. Tick **Authenticated SMTP** and select *Save changes*.

The mailbox setting overrides the organization setting, so this works even when SMTP AUTH is off for everyone else.

## 2. Or do it in PowerShell

Exchange Online PowerShell does the same thing and lets you check the current value:

```powershell
# Install-Module ExchangeOnlineManagement   (once)
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

# Is SMTP AUTH off for this mailbox? True = off, False = on, blank = follows the organization
Get-CASMailbox -Identity website@yourdomain.com | Format-List SmtpClientAuthenticationDisabled

# Turn it on for this one mailbox (overrides the organization setting)
Set-CASMailbox -Identity website@yourdomain.com -SmtpClientAuthenticationDisabled $false

# The organization-wide switch, for reference: True = off for everyone
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
```

## 3. Check security defaults and Conditional Access

If the error continues, Microsoft’s troubleshooting article lists these checks, in this order:

- Multifactor authentication on the mailbox blocks password sign-in over SMTP.
- Security defaults: *Microsoft Entra ID → Properties → Manage security defaults*. Microsoft warns not to switch them off unless you understand the risks.
- Conditional Access: exclude the mailbox from any policy that blocks legacy authentication.

These are organization-wide security decisions. A dedicated, licensed mailbox with a long random password, used only for sending, keeps the exception small.

## 4. Use the settings Microsoft documents

|  |  |
| --- | --- |
| Host | `smtp.office365.com` (the name, not an IP address) |
| Port | `587` with STARTTLS (SSL off in most apps) |
| TLS | TLS 1.2 or 1.3 |
| Username | The mailbox’s full email address |
| Password | The mailbox password |
| From address | The same mailbox, or one it has Send As permission for |

Don’t use port 465 here. Microsoft notes that a device or app that defaults to 465 doesn’t support the TLS that client submission requires. Microsoft also limits this method to 10,000 recipients a day and 30 messages a minute.

## Fix 5.7.60 and SendAsDenied

Set the From address to the mailbox you sign in with. If you need to send as another address (say `sales@` while signing in as `website@`), an admin must give the sign-in mailbox **Send As** permission on it.

## Microsoft’s SMTP AUTH timeline

Microsoft is retiring Basic authentication (username and password) for SMTP AUTH. Its current plan, from the Exchange Team blog post of January 27, 2026 (updated January 29), replaces the earlier March–April 2026 dates:

| When | What Microsoft says happens |
| --- | --- |
| Now to December 2026 | SMTP AUTH Basic Authentication behavior remains unchanged. |
| End of December 2026 | SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed. |
| New tenants created after December 2026 | SMTP AUTH Basic Authentication will be unavailable by default. OAuth will be the supported authentication method. |
| Second half of 2027 | Microsoft will announce the final removal date for SMTP AUTH Basic Authentication. |

We found no newer post on the Exchange Team blog as of November 2, 2026. In practice, expect `5.7.139` errors to appear in January 2027 in tenants where nobody has turned SMTP AUTH on, and plan to move off password SMTP before the final date. Microsoft’s suggested replacements are OAuth for SMTP AUTH, High Volume Email (internal recipients only) and Azure Communication Services Email.

## Outlook.com and Hotmail accounts

None of the above applies to personal accounts, and there’s no switch to flip. Microsoft says Basic authentication has been unavailable for every Outlook account since September 16, 2024, and its Outlook.com settings page says “Outlook.com requires the use of Modern Auth / OAuth2”. Any tool that signs in to `smtp-mail.outlook.com` with a password will fail, whatever the password. The [Outlook & Microsoft 365 guide](https://formsmtp.com/guides/outlook-smtp-contact-form) covers the alternatives.

**Using FormSMTP?** FormSMTP signs in to SMTP with a username and password. It works with a Microsoft 365 mailbox while Authenticated SMTP is on for it, and *Test connection* shows Microsoft’s exact reply, so you can confirm the steps above worked. It can’t use Outlook.com or Hotmail addresses. For anything long-lived, connect a sending service with your domain verified ([SES](https://formsmtp.com/guides/amazon-ses-smtp-contact-form), [Brevo](https://formsmtp.com/guides/brevo-smtp-contact-form), [Resend](https://formsmtp.com/guides/resend-smtp-contact-form)). Microsoft’s retirement doesn’t affect those. [Start free](https://app.formsmtp.com/#/signup).

More codes: the [SMTP error code reference](https://formsmtp.com/guides/smtp-error-codes). Settings for every provider: [SMTP settings](https://formsmtp.com/smtp-settings).

## Sources

Checked on the vendors’ own pages on November 2, 2026.

- [Microsoft Learn: Enable or disable SMTP AUTH in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission)
- [Microsoft Learn: Set up a device or application to send email using Microsoft 365](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
- [Microsoft Learn: Fix issues with printers, scanners, and LOB apps that send email](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/fix-issues-with-printers-scanners-and-lob-applications-that-send-email-using-off)
- [Exchange Team Blog: Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline](https://techcommunity.microsoft.com/blog/exchange/updated-exchange-online-smtp-auth-basic-authentication-deprecation-timeline/4489835)
- [Microsoft Support: Modern authentication now needed for Outlook email in non-Microsoft apps](https://support.microsoft.com/en-us/support/known-issues/modern-authentication-methods-now-needed-to-continue-syncing-outlook-email-in-non-microsoft-email-ap)
- [Microsoft Support: POP, IMAP, and SMTP settings for Outlook.com](https://support.microsoft.com/en-us/outlook/pop-imap-and-smtp-settings-for-outlook-com)

## FAQ

### How do I fix “SmtpClientAuthentication is disabled for the Tenant”?

An admin turns on Authenticated SMTP for the sending mailbox (Microsoft 365 admin center → Users → Active users → Mail → Manage email apps), or runs Set-CASMailbox -Identity mailbox -SmtpClientAuthenticationDisabled $false. The mailbox setting overrides the tenant setting.

### I enabled Authenticated SMTP and still get 535 5.7.3. Why?

Something else blocks password sign-in: security defaults, an authentication policy that disables Basic auth for SMTP, a Conditional Access policy blocking legacy authentication, or MFA on the mailbox.

### When does Microsoft turn off SMTP AUTH with a password?

Microsoft says it will be disabled by default for existing tenants at the end of December 2026, with admins still able to enable it. Tenants created after December 2026 won’t have it by default. The final removal date will be announced in the second half of 2027.

### Can I use smtp-mail.outlook.com with my Hotmail password?

No. Since September 16, 2024, personal Outlook accounts only accept OAuth (Modern Auth), so password-based SMTP fails.

### Should I use port 587 or 465 for Microsoft 365?

Port 587 with STARTTLS. Microsoft documents 587 (or 25) for client submission and says a device that defaults to 465 doesn’t support the TLS it requires.

## More guides

- [Gmail 535-5.7.8 Username and Password not accepted: fix](https://formsmtp.com/guides/gmail-smtp-username-password-not-accepted)
- [SMTP connection timed out (ETIMEDOUT): blocked port fix](https://formsmtp.com/guides/smtp-port-blocked-connection-timeout)
- [SMTP error codes explained: 421, 535, 550, 554 and more](https://formsmtp.com/guides/smtp-error-codes)
- [Contact form emails going to spam or not arriving: fixes](https://formsmtp.com/guides/contact-form-emails-going-to-spam)