Paessler PRTG Network Monitor email notifications with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: PRTG has no OAuth option for SMTP, so a relay login to smtp.office365.com with a password stops working once Basic auth is off. Point Notification Delivery at a Microsoft 365 relay connector (MX host, port 25, no login), Azure Communication Services or High Volume Email.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

PRTG's SMTP Relay Authentication offers Use no authentication (default), Use standard SMTP authentication and Use SASL authentication. The PRTG manual doesn't mention OAuth. Paessler's own Office 365 guide uses smtp.office365.com, port 587 and a mailbox username and password, which is Basic auth and is hit by the SMTP AUTH Basic auth switch-off. On Paessler's feedback portal the OAuth idea is marked Delivered, but Paessler's reply (December 2025) points to a knowledge base article with alternatives and names no release with OAuth. That knowledge base suggests High Volume Email for Microsoft 365 or an SMTP relay through Azure Communication Services. PRTG's relay fields (server, port, no authentication, TLS) also fit a Microsoft 365 relay connector.

What you will see when it breaks

Best fix

  1. Open Setup → System Administration → Notification Delivery. If SMTP Delivery uses relay server smtp.office365.com with Use standard SMTP authentication, PRTG logs in with a password and will fail once Microsoft turns Basic auth off by default at the end of December 2026. Our free, read-only SMTP AUTH sender script lists every SMTP AUTH sender in your tenant, including PRTG's mailbox.
  2. Pick a route. Alerts to anyone, including outside addresses: relay connector or Azure Communication Services. Alerts only to people in your tenant: High Volume Email also works.
  3. Relay connector: create it for the PRTG core server's static public IP (step by step). In PRTG set Delivery Mechanism to Use one SMTP relay server (recommended in LANs/NATs), SMTP Relay Server to your MX host (for example contoso-com.mail.protection.outlook.com), SMTP Relay Port to 25, SMTP Relay Authentication to Use no authentication (default), Connection Security to Use SSL/TLS if the server supports it (default) and SSL/TLS Method to TLS 1.2.
  4. Azure Communication Services (Paessler's guide, which it says it tested): create a Communication Services resource and an Email Communication Services resource with your verified domain, an Entra app with a client secret, and a custom role assigned to that app. In PRTG use SMTP Relay Server smtp.azurecomm.net, port 587, Use standard SMTP authentication, user name <resource name>.<app id>.<tenant id> and the client secret as password.
  5. High Volume Email: in the Exchange admin center go to Mail flow → High Volume Email → Add an HVE account and assign a pay-as-you-go billing policy (without one the account can't send). In PRTG use smtp.hve.mx.microsoft, port 587, Use standard SMTP authentication with the HVE account address and password. HVE delivers only to recipients in your tenant. If Security Defaults is on, HVE accepts only OAuth, which PRTG can't do.
  6. Test: Setup → Account Settings → Notification Templates, open an email notification that includes you as a receiver (for example Email to Admin) and click Test SMTP Settings.

If it can't do OAuth

  1. No static IP, or port 25 blocked? Use Azure Communication Services as above; it signs in on port 587 with the Entra app's secret.
  2. PRTG core server in Azure or another third-party cloud? Microsoft says a relay connector can't be used from there. Microsoft's own pointers are High Volume Email for internal recipients and Azure Communication Services Email for internal and external recipients.
  3. PRTG Hosted Monitor: the relay server, port and HELO fields aren't available there, so this page applies to PRTG Network Monitor installed on your own server.
  4. Stopgap only: a password login needs SMTP AUTH on for the mailbox (Set-CASMailbox -Identity prtg@yourdomain.com -SmtpClientAuthenticationDisabled $false) and Basic auth still allowed. After the end of December 2026 admins can turn Basic auth back on until a final removal date, which Microsoft will announce in the second half of 2027. Details: Basic auth retirement.
MenuSetup > System Administration > Notification Delivery > SMTP Delivery
OAuth for SMTPNot available (the PRTG manual lists no authentication, standard SMTP and SASL only)
Delivery MechanismUse one SMTP relay server (recommended in LANs/NATs)
Relay connectorServer: your MX host; port 25; Use no authentication (default); Use SSL/TLS if the server supports it (default); TLS 1.2
Azure Communication Servicessmtp.azurecomm.net; port 587; Use standard SMTP authentication; user <resource name>.<app id>.<tenant id>; password = Entra client secret
High Volume Emailsmtp.hve.mx.microsoft; port 587; HVE account address and password; internal recipients only; billed per recipient
TestSetup > Account Settings > Notification Templates > Test SMTP Settings

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Sources

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other devices and apps