Atlassian Jira Data Center outgoing mail (SMTP) with Microsoft 365: email through Microsoft 365 after Basic auth is switched off

Short answer: Jira Data Center 9.2 and later can send outgoing mail through Microsoft 365 with OAuth 2.0 (an Application link of type External application, direction Outgoing, with the SMTP.Send scope). An outgoing server that still logs in with a user name and password stops working when Basic auth is switched off. Move it to OAuth 2.0, or on Jira older than 9.2 use a relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Supported on Jira Data Center 9.2 and later. Atlassian: "OAuth 2.0 for SMTP outgoing mail servers is supported in Jira 9.2 and above." You create the link under Administration → Applications → Application links → Create link → External application with direction Outgoing and provider Microsoft, register an app in Microsoft Entra (platform Web, Jira's redirect URL, Microsoft Graph delegated permissions plus SMTP.Send and offline_access, admin consent, a client secret), then pick the link on the outgoing SMTP server. Scopes in Atlassian's docs: https://outlook.office.com/SMTP.Send and offline_access; for GCC tenants Atlassian says to use outlook.office365.com. Jira must run over HTTPS with a correct base URL. Jira Server is out of scope (Atlassian: support ended 15 February 2024). Atlassian says it can't guarantee support for the Microsoft-side steps. Without OAuth, a password login is SMTP AUTH Basic auth and is switched off by default at the end of December 2026.

What you will see when it breaks

"This authentication method is deprecated, you should use OAuth 2.0 instead." (Atlassian: warning shown in Jira email settings for password authentication)
"535 5.7.3 Authentication unsuccessful" (Microsoft Learn: example SMTP response when an AUTH attempt is refused)
"5.7.57 Client not authenticated to send mail" (Microsoft Learn: SMTP AUTH refused; check the mailbox's Authenticated SMTP setting)
Reported: issue notification emails, mentions and Jira Service Management customer emails stop arriving while the outgoing mail server test fails (no official Atlassian wording found)

Best fix

Check your version: Administration → System → Support tools / System info shows the Jira version. Outgoing SMTP over OAuth 2.0 needs 9.2 or later (Atlassian). Then open Administration → System → Outgoing Mail and note whether the server uses a user name and password. To list every mailbox in the tenant that still logs in over SMTP AUTH, run the free SMTP AUTH sender script.
Make sure Jira runs over HTTPS and the base URL is correct, because the redirect URL is built from it. Atlassian also says to open port 443 for inbound and outbound traffic.
Create the link: Administration → Applications → Application links → Create link → External application, direction Outgoing, provider Microsoft. Copy the redirect URL Jira shows.
In Microsoft Entra, register an app (platform Web, paste the redirect URL). Add delegated permissions SMTP.Send and offline_access (Atlassian's article lists these under Microsoft Graph delegated permissions; Microsoft Learn lists SMTP.Send under Office 365 Exchange Online), grant admin consent, create a client secret and copy its Value, and copy the Application (client) ID.
Back in Jira, enter the Client ID, Client secret and scopes (https://outlook.office.com/SMTP.Send offline_access) and save. Atlassian's article uses outlook.office.com in one place and outlook.office365.com in another; Microsoft Learn's SMTP scope is https://outlook.office.com/SMTP.Send.
Create or edit the SMTP server under Outgoing Mail: service provider Microsoft Exchange Online / Outlook, authentication OAuth 2.0, select the link and the SMTP scope, then authorize with the mailbox that will send. Which account the authorization screen asks for is not detailed in the pages read; use a dedicated mailbox with Authenticated SMTP enabled (Microsoft Learn describes that setting for SMTP AUTH).
Send a test from Outgoing Mail. Atlassian notes JSM doesn't fully support shared mailboxes with OAuth 2.0 and recommends a dedicated account.

If it can't do OAuth

Jira older than 9.2, or no way to use OAuth: Atlassian documents OAuth 2.0 for SMTP only from 9.2. Use the relay connector approach instead: point the outgoing server at your MX host on port 25 with no user name, and trust Jira's static public IP in the connector. That the Jira SMTP form accepts a blank user name is not documented in the pages read.
Without a connector, the MX host on port 25 is direct send, which only reaches mailboxes inside your organization (Microsoft Learn). See 550 5.7.68 if direct send is blocked in your tenant.
Set the sender to an address in a domain your tenant owns, or Microsoft 365 rejects the message (see 550 5.7.64 TenantAttribution).
Stopgap only: an admin can turn Basic auth for SMTP AUTH back on for now. See the SMTP AUTH change.

Supported versions (Atlassian)	`Jira Data Center 9.2 and later for OAuth 2.0 on outgoing SMTP; 8.22 and later for the Application links screen`
Application link path	`Administration > Applications > Integrations > Application links > Create link > External application`
Link direction / provider	`Outgoing / Microsoft`
Scopes (non-GCC)	`https://outlook.office.com/SMTP.Send, offline_access`
Scopes (GCC)	`outlook.office365.com in place of outlook.office.com (Atlassian)`
Entra app registration	`Platform Web, redirect URL from Jira, delegated SMTP.Send and offline_access, admin consent, client secret`
Prerequisites (Atlassian)	`HTTPS, correct base URL, port 443 open`
Outgoing Mail form	`Service provider Microsoft Exchange Online / Outlook, authentication OAuth 2.0`
Shared mailboxes	`JSM doesn't fully support shared mailboxes with OAuth 2.0; dedicated account recommended`
Jira Server	`Support ended 15 February 2024 (Atlassian); Data Center only`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

MSP or IT partner? The M365 Readiness Pack checks SMTP AUTH, EWS and SPF/DKIM/DMARC per client tenant and writes a report with your logo (from $49).

Sources

Did this fix it?