Connect Outlook to Instantly: Microsoft 365 and Admin Consent

To connect a Microsoft 365 Outlook mailbox to Instantly, turn on IMAP and Authenticated SMTP for that mailbox in the Microsoft 365 admin center, wait about an hour, then sign in through Instantly's Office 365 / Outlook connector as the mailbox user and accept the permission request. If Microsoft shows Need admin approval, the tenant's consent policy is doing its job: an Entra admin has to approve the Instantly app once for the organization before that user can finish. Instantly says Microsoft accounts are connected one at a time through this OAuth connector; there is no bulk import for them.

This guide follows Instantly's Microsoft 365 connection article, its SMTP settings article and its account connection overview, plus Microsoft Learn's documentation on SMTP AUTH and Entra admin consent, all checked October 16, 2026. We have not connected a private Microsoft tenant or Instantly workspace for this article. OutboundXYZ has an affiliate relationship with Instantly; that relationship did not decide these steps.

Use the right branch: Business and enterprise Microsoft 365 mailboxes go through Connect Existing → Office 365 / Outlook. Instantly's Azure setup article says free hotmail.com and outlook.com addresses are not supported. Google Workspace has its own path, covered in our Instantly Google OAuth guide.

What the Microsoft connector actually asks for

The screenshot in Instantly's connection article shows a Microsoft Permissions requested screen for an app named Instantly, with a verified publisher listed as Foo Monk LLC. It requests five permissions: View users' basic profile, Maintain access to data you have given it access to, Read and write access to mailboxes via IMAP, Send emails from mailboxes using SMTP AUTH and Send mail as a user. Compare your live prompt with Instantly's current article; vendor screenshots age.

Two of those explain most failed connections. Microsoft's OAuth guide for IMAP and SMTP lists separate OAuth scopes for IMAP and SMTP AUTH: OAuth replaces the mailbox password, but the connection still uses those protocols. That's why Instantly asks you to enable IMAP and Authenticated SMTP on each mailbox even though you never type a password into Instantly.

It also answers the deprecation question. Microsoft's January 2026 timeline update says Basic authentication for SMTP AUTH becomes disabled by default for existing tenants at the end of December 2026, with a final removal date to be announced in the second half of 2027. That targets username-and-password sign-in; OAuth is the supported method. The per-mailbox Authenticated SMTP setting is a different control, and it still has to be on.

Before you start

You need:

A licensed user mailbox. Instantly's Microsoft 365 account setup article says to assign the new user a license, and its alias accounts article says connected accounts need to be real users with paid licenses and real inboxes. Shared mailboxes and aliases don't fit this flow (see the troubleshooting table).
A Microsoft 365 admin who can edit the user's mail settings, to turn on Authenticated SMTP.
Someone who can grant consent in Microsoft Entra, if your tenant blocks user consent. For delegated permissions like these, Microsoft lists Cloud Application Administrator, Application Administrator, AI Administrator or Privileged Role Administrator.
An Instantly workspace where you can add sending accounts, and the mailbox user's ability to sign in to Microsoft (MFA included).

Why bother with Microsoft at all? In a May 2024 video, Jan recommended splitting sending inboxes roughly 50/50 between Outlook and Google, so a bad stretch on one provider doesn't stall everything, and leaning toward Outlook for larger corporate targets. That's his historical opinion, not a measured result. Microsoft's outbound spam guidance says bulk email is not a supported use of Microsoft 365, so plan volume accordingly. Our agency mailbox provider comparison covers the Exchange Online cost and policy tradeoffs.

Step 1: Turn on IMAP and Authenticated SMTP for each mailbox

For mailboxes bought directly from Microsoft, Instantly and Microsoft's SMTP AUTH article describe the same path:

Open the Microsoft 365 admin center and go to Users → Active users.
Select the user. In the flyout, select Mail.
In the Email apps section, select Manage email apps.
Check IMAP and Authenticated SMTP.
Select Save changes.
Wait about an hour before connecting the mailbox to Instantly, as Instantly instructs.

Microsoft says IMAP is enabled by default when a user mailbox is created. Authenticated SMTP is the one more likely to be off, which is why Instantly has a dedicated "SMTP is disabled" error. The per-mailbox setting overrides the organization-wide Turn off SMTP AUTH protocol for your organization setting in the Exchange admin center, so you can keep SMTP AUTH off for everyone else and enable it only for sending mailboxes. That's the pattern Microsoft recommends.

For many mailboxes, Microsoft documents an Exchange Online PowerShell equivalent: Set-CASMailbox -Identity <mailbox> -SmtpClientAuthenticationDisabled $false. A value of $null hands control back to the organization setting.

GoDaddy-hosted Microsoft 365: Instantly's steps are My Products → Email and Office → Manage all, select Manage next to the user, open Advanced Settings under Account information, turn on SMTP Authentication, then wait an hour.

Security defaults: Microsoft's SMTP AUTH article says that when Entra security defaults are enabled, SMTP AUTH is already disabled. Instantly's Azure setup article walks into the tenant's Entra Properties page, where Microsoft keeps Manage security defaults. Treat this as a tenant security decision, not a connection tweak: Microsoft says organizations that turn security defaults off should immediately enable Conditional Access policies to keep protections such as MFA. If you don't own that tenant's security, involve the person who does.

Step 2: Decide how the tenant will grant consent

Whether the mailbox user can accept Instantly's permissions on their own depends on the tenant's User consent for applications setting. Microsoft's user consent guide puts it under Enterprise apps → Consent and permissions → User consent settings in the Microsoft Entra admin center. Its built-in options are to block user consent, to allow it only for verified publishers and permissions the admin classifies as low impact, or to allow it for any app. Microsoft recommends limiting user consent to verified publishers.

Don't loosen that tenant-wide setting just to connect one sending tool. Approve the specific app instead. Microsoft documents three ways to do that:

Path	Who does it	When it fits
Tick Consent on behalf of your organization on the permission screen	A signed-in admin. Microsoft's consent experience docs say the box appears only for Privileged Role Administrator or higher	The mailbox you're connecting belongs to such an admin. This is the checkbox Instantly's article tells you to tick, and it notes you may not see it.
Approve an admin consent request	The user selects Request approval on the Approval required screen; a designated reviewer approves it	The tenant has the admin consent workflow turned on.
Grant admin consent in Enterprise apps	A Cloud Application Administrator or higher	The Instantly app already appears under Enterprise apps → All applications, for example because a user consented earlier.

In Instantly's flow, the account that signs in is the mailbox being connected. Signing in as an admin to tick the box therefore connects the admin's mailbox, too. Don't give a sending mailbox an admin role just to see the checkbox; Microsoft recommends roles with the fewest permissions.

Request path: a Global Administrator sets Users can request admin consent to apps they are unable to consent to to Yes under Enterprise apps → Consent and permissions → Admin consent settings and picks reviewers; Microsoft says activation can take up to an hour. A reviewer then opens Enterprise apps → Admin consent requests → My Pending, selects the app and chooses Review permissions and consent (Microsoft's review guide).

Enterprise apps path: open Enterprise apps → All applications, select the app, choose Permissions under Security, review the list and select Grant admin consent. Either way, Microsoft warns that tenant-wide consent lets every user in the tenant use the app unless you turn on Assignment required and assign specific users.

Step 3: Connect each mailbox in Instantly

In Instantly, open Email Accounts from the left sidebar.
Select Add or Buy Accounts (some Instantly help text still calls it Add New).
Choose Connect Existing, then Office 365 / Outlook (listed as Microsoft in the overview article).
Instantly reminds you to enable SMTP, with separate instructions for Microsoft-purchased and GoDaddy-purchased accounts. Once Step 1 is done, select Yes, the SMTP has been enabled (wording varies slightly in Instantly's screenshots).
In the Microsoft window, pick the mailbox you're connecting. If it isn't listed, select Use another account and sign in as that user. A private browser window helps when another Microsoft session is already signed in.
Review the Permissions requested screen. Check the app name, publisher and permission list against your approved policy, then select Accept. If you're an eligible admin connecting your own mailbox, tick Consent on behalf of your organization only if you intend to approve the app tenant-wide.
Confirm the address appears in Email Accounts without an error, then repeat from step 2 for the next mailbox.

Instantly suggests enabling warmup and a custom tracking domain next; those are separate decisions. Connecting a mailbox doesn't assign it to a campaign, set DNS records or prove inbox placement.

Fix the specific failure

What you see	Likely cause	Next action
Need admin approval, or an error such as AADSTS90094 or AADSTS65001	User consent is blocked or limited for these permissions, or the app isn't in the tenant yet. Microsoft's consent troubleshooting article lists these causes.	Use one of the Step 2 consent paths, then retry the Instantly connection as the mailbox user.
Approval required with a Request approval button	The admin consent workflow is on.	Submit the request with a short justification and ask the designated reviewer to approve it.
Admin approved, but the prompt still appears	Not every requested permission was consented, or Assignment required is on and this user isn't assigned.	Compare the app's Permissions list in Enterprise apps with what the prompt requests; assign the user if assignment is required.
Account shows SMTP is disabled after connecting	Authenticated SMTP is off for that mailbox.	Per Instantly's disconnected account guide: enable SMTP, remove the account from Instantly, wait one hour, then reconnect through Connect existing → Microsoft.
SMTP errors continue after enabling it and waiting an hour	Check whether Entra security defaults are on; Microsoft says they disable SMTP AUTH.	Take it to the tenant's security owner (see the Step 1 note).
Can't Create New Access Token	Instantly says a recent password change or an expired token is the usual cause.	Delete the account in Instantly and connect it again through the Microsoft connector. Our disconnected-account guide covers the full repair.
A shared mailbox or alias won't connect	Microsoft says a shared mailbox's account shouldn't be used for direct sign-in and sign-in should stay blocked; Instantly doesn't support aliases.	Create a licensed user mailbox for sending instead of unblocking a shared mailbox's sign-in.

Verify the connection

Check each layer separately so you know which one failed:

Microsoft mailbox: Manage email apps shows IMAP and Authenticated SMTP checked, or Get-CASMailbox -Identity <mailbox> | Format-List SmtpClientAuthenticationDisabled returns False.
Consent: In Enterprise apps, the app's Permissions page lists what has been granted. Microsoft notes that profile and offline-access scopes often don't appear there.
Instantly account: The mailbox appears in Email Accounts with no error status. Instantly's Test domain setup button on that dashboard checks MX, SPF, DKIM and DMARC records; our SPF, DKIM and DMARC explainer covers what each one does.
Campaign readiness: Assign the mailbox to a campaign and confirm schedule, limits and eligible leads. If nothing sends, work through why an Instantly campaign may not send.

A clean connection proves Instantly can reach the mailbox, not that Microsoft will accept your volume or that recipients will see the mail. The email deliverability readiness test checks public DNS signals within its stated limits. For the tool decision itself, see our Instantly review or the Microsoft 365 integration hub, which compares other sending tools that connect Microsoft inboxes.

Frequently asked questions

Do I need to be a Microsoft 365 admin to connect Outlook to Instantly?

Not always. A regular user can accept the permissions if the tenant's user consent settings allow it. An admin still has to turn on Authenticated SMTP for the mailbox, and if the tenant blocks user consent, an admin has to approve the app before the user can finish.

Can I connect an Outlook mailbox to Instantly with IMAP/SMTP and a password instead?

Instantly's overview says Outlook accounts must be connected individually through the Microsoft connector with OAuth. Its GoDaddy PowerShell article still lists password-based settings for smtp.office365.com, but Microsoft is disabling Basic authentication for SMTP AUTH by default for existing tenants at the end of December 2026. Use the Office 365 / Outlook connector.

Will Microsoft's Basic auth retirement break an OAuth connection?

It shouldn't, based on Microsoft's announcement: the change removes username-and-password authentication for SMTP AUTH, and OAuth is the supported method going forward. The mailbox's Authenticated SMTP setting still needs to stay enabled, because the OAuth connection uses that protocol.

Can I bulk import Microsoft 365 accounts into Instantly?

No. Instantly says Microsoft accounts must be connected one at a time through the OAuth connector; bulk connection isn't available for them. Tenant-wide admin consent saves each user from a separate approval, but each mailbox user still signs in once.