Jenkins email notifications (Mailer and Email Extension plugins) with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: The Mailer plugin only logs in with a user name and password, so it fails once Basic auth is off. Email Extension has a Use OAuth 2.0 box, but it doesn't fetch or refresh a Microsoft token. The working fix is a relay connector: SMTP server = your MX host, port 25, no credentials.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Mailer (Manage Jenkins → Configure System → E-mail Notification): Use SMTP Authentication with a user name and password, nothing else. Its code has no OAuth option. Email Extension (section Extended E-mail Notification) has a Use OAuth 2.0 checkbox under Advanced. In the plugin's source it only switches the SMTP login to XOAUTH2 and sends the password of the selected Credentials as the token; it doesn't request or refresh a token from Microsoft. Jenkins issue JENKINS-73486 ("OAuth 2.0 does not work with O365", In Progress) reports that a client secret in that field fails with 535 5.7.3, and that a token fetched by hand works but is only valid for about an hour. Jenkins selected a 2026 Google Summer of Code project to add Microsoft OAuth (client credentials) to Email Extension; it is not in a release yet. Until then, a Jenkins account on smtp.office365.com is hit by the SMTP AUTH Basic auth switch-off.

What you will see when it breaks

Best fix

  1. Check both sections under Manage Jenkins → Configure System: E-mail Notification (Mailer) and Extended E-mail Notification (Email Extension). smtp.office365.com with a user name and password or Credentials is Basic auth and fails once Microsoft turns it off by default at the end of December 2026. The free SMTP AUTH sender script shows whether the Jenkins mailbox still logs in over SMTP AUTH.
  2. Create a relay connector in Exchange admin center (Mail flow → Connectors, from Your organization's email server) that trusts the static public IP your Jenkins controller sends from.
  3. Mailer (E-mail Notification): SMTP server your MX host (for example contoso-com.mail.protection.outlook.com), SMTP Port 25, untick Use SMTP Authentication, untick Use SSL (that is implicit SSL, port 465) and tick Use TLS (STARTTLS).
  4. Email Extension (Extended E-mail Notification): same SMTP server and SMTP Port 25. Under Advanced, set Credentials to none, untick Use SSL and Use OAuth 2.0. Check any extra SMTP accounts in that section too.
  5. Make sure the sender address is in a domain your tenant owns, or Microsoft 365 rejects it (see 550 5.7.64 TenantAttribution).
  6. Tick Test configuration by sending test e-mail in E-mail Notification, enter a recipient and click Test configuration. Then run a job with an email step.

If it can't do OAuth

  1. No static IP (for example Jenkins in a cloud with changing egress)? Point Jenkins at a local SMTP relay that signs in to Microsoft 365 itself. Jenkins only needs an SMTP server and port.
  2. Without a connector, the MX host on port 25 is direct send: it only reaches mailboxes inside your organization (Microsoft Learn). If your tenant rejects it, see 550 5.7.68.
  3. Email Extension with Use OAuth 2.0 plus a token you fetch yourself (Entra app with SMTP.SendAsApp, New-ServicePrincipal, Add-MailboxPermission, scope https://outlook.office365.com/.default) can send, but JENKINS-73486 reports the token must be replaced about every hour. Not a set-and-forget fix.
  4. Stopgap only: an admin can turn Basic auth for SMTP AUTH back on for now. It ends when Microsoft removes it for good; the date is due in the second half of 2027. See the SMTP AUTH change.
Mailer pathManage Jenkins > Configure System > E-mail Notification
Mailer fieldsSMTP server, Default user e-mail suffix, Use SMTP Authentication (User Name, Password), Use SSL, Use TLS, SMTP Port, Reply-To Address, Charset
Email Extension pathManage Jenkins > Configure System > Extended E-mail Notification
Email Extension account fieldsSMTP server, SMTP Port (default 25); Advanced: Credentials, Use SSL, Use TLS, Use OAuth 2.0, Advanced Email Properties
Use OAuth 2.0 (Email Extension)Sets XOAUTH2 and sends the credential password as the token; no Microsoft token request or refresh
Mailer OAuthNot documented (password login only)
Use SSL vs Use TLSUse SSL = implicit SSL (465 if no port set); Use TLS = STARTTLS required (587 if no port set)
Relay valuesSMTP server: your MX host, SMTP Port: 25, no authentication or Credentials, OAuth off
Microsoft OAuth status in Email ExtensionJENKINS-73486 In Progress; GSoC 2026 project selected, not released

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Sources

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other devices and apps