To connect a Microsoft 365 mailbox to Smartlead, have a Microsoft 365 admin turn on Authenticated SMTP and IMAP for that specific mailbox, wait 20 to 30 minutes, then open Smartlead's Email Accounts → + Connect Mailbox → Smartlead's Infrastructure → Outlook and sign in as that mailbox in Microsoft's window. Accept the permissions prompt and the account should show a green Connected status. There's no app password, and Smartlead says the flow doesn't require handing your password to Smartlead directly. If Microsoft says the app needs admin approval, that's your tenant's consent policy, which only a Microsoft admin can clear. Smartlead's Outlook OAuth guide covers the Smartlead side; Microsoft's SMTP AUTH article covers the mailbox switch.
What we checked, and what we didn't: Smartlead's help-center articles on Outlook OAuth, its own-Azure-app setup, mailbox connection, disconnections and the 550 5.7.708 error, plus Microsoft Learn pages on SMTP AUTH, Entra consent, Exchange Online limits and DKIM, all read on October 16, 2026. We did not connect a mailbox in a private Smartlead account or change a live Microsoft 365 tenant, so this is a documentation-based procedure. OutboundXYZ has an affiliate relationship with Smartlead; it did not decide these steps.
OAuth doesn't mean SMTP AUTH is switched off
Microsoft says the SMTP AUTH protocol supports OAuth as well as basic authentication, and recommends disabling it organization-wide and enabling it only for mailboxes that still need it. Smartlead's managed Outlook connection is one of those cases: its guide makes Authenticated SMTP and IMAP a prerequisite even though you sign in through OAuth.
What Microsoft is retiring is basic authentication (a username and password) over SMTP AUTH. Its January 27, 2026 Exchange Team update sets the current timeline:
- Until December 2026: SMTP AUTH basic authentication behaves as it does today.
- End of December 2026: it becomes disabled by default for existing tenants. Admins can still turn it back on.
- Tenants created after December 2026: it's unavailable by default, and OAuth is the supported method.
- Second half of 2027: Microsoft says it will announce the final removal date.
Some guides still say basic auth for SMTP was switched off on March 1, 2026. That date came from Microsoft's earlier schedule, which it replaced in January. Our reading: an OAuth-connected Smartlead mailbox is on Microsoft's supported path; a Microsoft mailbox added with a password-based SMTP connection is what the retirement targets.
Pick the connection path
| Path | What it is | Microsoft-side work | Use it when |
|---|---|---|---|
| Smartlead's Infrastructure → Outlook | Smartlead's managed OAuth app | Authenticated SMTP and IMAP per mailbox; consent if your tenant restricts it | You want the documented default with no Azure app to maintain |
| Your Email Network → Outlook | Your own Azure app registration and OAuth credentials | App registration, Microsoft Graph delegated permissions, admin consent, client secret | You need a branded client flow or your own OAuth app, and your plan includes it |
| SMTP (generic option) | Host, port, username and password | Depends on basic auth for Microsoft 365 | Avoid for new Microsoft 365 senders, given the retirement timeline |
Smartlead's mailbox connection overview says Your Email Network (formerly "Your Private Infrastructure") is limited to its Smart and Prime plans. Check the current pricing page before planning around it.
Before you start
| Requirement | Why it matters |
|---|---|
| A licensed user mailbox in Exchange Online that can sign in | You sign in as the mailbox. Microsoft says a shared mailbox isn't intended for direct sign-in, which should stay blocked. |
A custom domain address, not name@tenant.onmicrosoft.com |
Microsoft's Exchange Online limits cap mail from default onmicrosoft.com domains at 100 external recipients per organization per 24 hours, with 550 5.7.236 bounces beyond that. |
| Someone with Microsoft 365 admin rights | Smartlead says the SMTP and IMAP switch needs admin access. Consent may need an Entra admin too. |
| Time for one sign-in per mailbox | Smartlead says bulk upload isn't available for Outlook because each account needs its own OAuth connection. |
| DKIM, SPF and DMARC for the sending domain | Microsoft's DKIM guide says custom domains need their own DKIM signing setup. Connecting doesn't configure it. |
Step 1: Turn on Authenticated SMTP and IMAP for each mailbox
This is an admin task in the Microsoft 365 admin center:
- Go to Users → Active users and select the user whose mailbox will send.
- In the flyout, select Mail.
- Under Email apps, select Manage email apps.
- Check Authenticated SMTP and IMAP, then select Save changes.
- Wait 20 to 30 minutes before connecting. Smartlead's FAQ lists an early attempt as one reason a first connection fails.
You don't need SMTP AUTH on for the whole organization. Microsoft says the per-mailbox setting overrides the tenant-wide one, so Turn off SMTP AUTH protocol for your organization can stay on while specific senders are enabled. For many mailboxes, Microsoft documents Set-CASMailbox -Identity <mailbox> -SmtpClientAuthenticationDisabled $false and a loop over a text file of addresses. To confirm, Get-CASMailbox -Identity <mailbox> | Format-List SmtpClientAuthenticationDisabled should return False.
Two Microsoft caveats can make a correctly ticked box do nothing:
- Security defaults. Microsoft's SMTP AUTH article says that with security defaults enabled, SMTP AUTH is already disabled, and using it means disabling security defaults. That removes baseline protections such as required MFA registration, so it's your admin's decision. Microsoft's security defaults guide points organizations with Entra ID P1 or P2 toward Conditional Access instead.
- Authentication policies. If an authentication policy disables basic authentication for SMTP, Microsoft says clients can't use SMTP AUTH even with the settings above.
Step 2: Settle consent before the first sign-in
Smartlead's FAQ says that once SMTP and IMAP are enabled, users can connect their own accounts without admin access. That holds only if your Entra tenant lets users consent to the Smartlead app. Microsoft's user consent settings sit in the Microsoft Entra admin center under Enterprise apps → Consent and permissions → User consent settings, where an admin can limit consent to verified publishers and selected low-impact permissions, or turn it off.
If users can't consent, Microsoft shows one of these instead of the permissions prompt:
- AADSTS90093 or AADSTS90094: the user can't grant the requested permissions, or a policy blocks user consent. An admin must grant access for the organization.
- Approval required: the admin consent workflow is on. The user adds a justification and selects Request approval.
- AADSTS900941: Microsoft considers the request risky. Users can't consent; an admin should evaluate the app before approving.
An admin with at least the Cloud Application Administrator role can grant tenant-wide admin consent under Enterprise apps → All applications → the app → Permissions → Grant admin consent, once the app exists in the tenant. Microsoft notes tenant-wide consent opens the app to all users unless user assignment is required. Smartlead's managed Outlook guide doesn't publish its Microsoft client ID or permission list, so the admin should review the permissions on the consent screen. If the app isn't in your tenant yet, use the consent-workflow request, or ask Smartlead support for the client ID and use Microsoft's https://login.microsoftonline.com/{organization}/adminconsent?client_id={client-id} URL.
After approval, Microsoft says the user must start a new sign-in. An AADSTS65004 error right after submitting a request is expected.
Step 3: Connect the mailbox in Smartlead
- In Smartlead, open Email Accounts from the left sidebar.
- Select + Connect Mailbox in the top-right corner.
- Choose Smartlead's Infrastructure, then Outlook.
- In Microsoft's sign-in window, enter the sending mailbox's address and password and select Sign In. Complete any MFA prompt your tenant requires.
- On the permissions prompt for the Smartlead app, select Accept.
- Confirm the mailbox shows a green Connected status with the exact address you intended.
Repeat for each mailbox. A practical tip from us, not Smartlead: if you connect several mailboxes in one session, sign out of Microsoft between them or use a fresh private window, so a cached session doesn't silently connect the wrong account.
Alternative: your own Azure app (Your Email Network)
Smartlead's Email Network guide for Outlook asks you to involve your Smartlead Customer Success Manager before creating the app, because mistakes can affect deliverability. In outline:
- In the Azure portal, create a New registration under App registrations (its name is what users see at sign-in) for Accounts in any organizational directory, with the Web redirect URI
https://server.intellioauth.com/api/email-account/microsoft/callback. - Under API permissions, add nine Microsoft Graph delegated permissions (offline_access, openid, email, profile, User.Read, Mail.Send, Mail.ReadWrite, Mail.ReadWrite.Shared, Mail.Send.Shared), then Grant admin consent.
- Under Certificates & secrets, create a New client secret. Smartlead recommends a 90 to 180 day expiry.
- In Smartlead's admin account, open Profile → Settings → OAuth Configuration → Outlook, paste the Application (client) ID and secret value, and select Activate. Optionally toggle Allow clients to use this so clients connect through your branded app.
- Connect mailboxes through Your Email Network → Outlook.
Put the secret's expiry in your operations calendar; Smartlead's guide doesn't describe rotation, so ask your CSM how to replace it. The guide also doesn't mention the Authenticated SMTP switch for this path, so confirm whether your mailboxes still need it.
Verify before the mailbox joins a campaign
A green status proves Smartlead can reach the mailbox, not that the sender is ready. Check:
- Smartlead: the address and status are right, and the daily cap and minimum time gap are set deliberately. Smartlead's disconnection guide suggests 10 to 15 minute gaps, 40 to 50 total sends a day including warmup in early stages, and a SmartDelivery test before scaling. That's vendor guidance, not a guarantee.
- Microsoft:
SmtpClientAuthenticationDisabledreadsFalsefor the mailbox. The SMTP AUTH Clients Submission Report in the Exchange admin center shows whether submissions use OAuth or basic auth, according to Microsoft's retirement announcement. - DNS: check the sending domain with our SPF checker, DKIM checker and DMARC checker.
Troubleshooting by symptom
| Symptom | Likely cause and fix |
|---|---|
| Connection fails after Accept | Smartlead says to disconnect, reconnect and approve every permission screen, then confirm Authenticated SMTP and IMAP are on and 20 to 30 minutes have passed. |
| Error says SMTP client authentication is disabled | The mailbox or tenant has SMTP AUTH off, or security defaults or an authentication policy block it. Recheck Step 1. |
| AADSTS90093, AADSTS90094 or Approval required | Tenant consent policy. An admin grants consent or approves the request; then start a new connection. |
| 550 5.7.708 Access denied | Smartlead's 5.7.708 guide says Microsoft blocked outgoing traffic over low IP reputation, most often on new or trial tenants. An admin opens Support → New service request in the Microsoft 365 admin center; afterwards, Reconnect the mailbox. |
| 550 5.7.236 bounces | Sending from an onmicrosoft.com address. Move to a custom domain. |
| A working mailbox later shows disconnected | Smartlead lists expired or revoked OAuth tokens, password or 2FA changes, and Microsoft safety controls. Select it in Email Accounts, open the gear icon, and choose (Re)connect Emails in Advanced Settings. Our disconnected-mailbox guide covers the other causes. |
A disconnected mailbox sends nothing, and Smartlead keeps each started lead on the same mailbox for the whole sequence, so reconnect rather than delete it. Its re-association guide explains the stalled-lead state.
Agency notes for client-owned tenants
When the client owns the Microsoft 365 tenant, their admin performs Steps 1 and 2. Don't ask for a Global Administrator password: Microsoft recommends the least-privileged role that can do the job, and a Cloud Application Administrator can grant consent for delegated permissions. Every Outlook mailbox also needs an interactive sign-in, so schedule that with the client instead of collecting mailbox passwords in a spreadsheet. Then assign each mailbox and campaign to the right client; our Smartlead client access guide covers both assignments.
Microsoft is blunt about volume. Its outbound spam guidance says bulk email isn't a supported use of Microsoft 365 and is handled on a best-effort basis. Exchange Online caps each mailbox at 30 messages per minute and 10,000 recipients per day, and a tenant-wide external recipient limit depends on licenses (5,000 a day for trial tenants). Those are ceilings, not targets.
Why use Microsoft senders at all? In a May 2024 video, Jan recommended splitting sending inboxes roughly 50/50 between Outlook and Google, so a bad period on one provider doesn't stall everything, and leaning toward Outlook for corporate-style prospects. That's his dated view, not a current deliverability test. If you're still choosing where mailboxes come from, our mailbox provider comparison for agencies weighs direct Microsoft accounts against managed options. For Google senders, use the Smartlead Google Workspace OAuth guide; for the platform decision, see our Smartlead review.
Frequently asked questions
Does Smartlead support Microsoft 365 and Outlook OAuth?
Yes. Smartlead documents a managed path (Smartlead's Infrastructure → Outlook) and an own-app path (Your Email Network → Outlook). Smartlead says the second is limited to its Smart and Prime plans.
Why does Smartlead need Authenticated SMTP if it uses OAuth?
Microsoft's SMTP AUTH protocol accepts OAuth tokens as well as passwords, and Smartlead's managed Outlook guide requires the per-mailbox Authenticated SMTP and IMAP switches. OAuth replaces the password, not the protocol.
Will Microsoft's basic auth retirement break my Smartlead Outlook connection?
It targets password-based SMTP AUTH, disabled by default for existing tenants at the end of December 2026 under Microsoft's current timeline. An OAuth-connected mailbox uses the method Microsoft supports; a Microsoft mailbox connected with SMTP credentials is the one to migrate.
Can I bulk-upload Outlook mailboxes to Smartlead?
Not currently. Smartlead says each Outlook account needs its own OAuth connection, so CSV bulk upload isn't supported for Outlook.
Disclosure: OutboundXYZ has an affiliate relationship with Smartlead. The steps come from Smartlead's and Microsoft's public documentation, checked October 16, 2026, not from a private account test. Confirm your tenant's security policies before changing them.
