Microsoft SQL Server Database Mail (and SQL Agent alerts) with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: Database Mail has no OAuth option: its SMTP Authentication choices are Windows, Basic or Anonymous. A Basic authentication account on smtp.office365.com stops working when Basic auth is switched off. Point the account at your MX host on port 25 with Anonymous authentication behind a relay connector, or use a local relay.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Not documented. Microsoft's Database Mail pages (SQL Server 2017 to 2025 and Azure SQL Managed Instance) list three SMTP Authentication options: Windows Authentication using Database Engine service credentials (NTLM, which Microsoft says is only available with Exchange on-premises), Basic Authentication (user name and password) and Anonymous authentication. sysmail_add_account_sp has no token or OAuth parameter either. So an account that logs in to smtp.office365.com with a mailbox password is Basic auth and is hit by the SMTP AUTH Basic auth switch-off. SQL Server 2016 is not covered by the current pages; OAuth for it is not documented either. The TDS 8.0 support added in SQL Server 2025 is about client connections to SQL Server, not about SMTP sign-in.

What you will see when it breaks

Best fix

  1. Find the failing account. In SSMS go to Management → Database Mail → View Database Mail Log, or run SELECT * FROM msdb.dbo.sysmail_event_log; and join sysmail_faileditems on mailitem_id. To list every mailbox in the tenant that still logs in over SMTP AUTH, run the free SMTP AUTH sender script.
  2. Open the account: right-click Database Mail → Configure Database Mail → Manage Database Mail accounts and profiles → View, change, or delete an existing account. Server name smtp.office365.com with Basic Authentication is the setup that fails once Microsoft turns Basic auth off by default at the end of December 2026.
  3. In Exchange admin center, create a relay connector (Mail flow → Connectors, from Your organization's email server) that trusts the static public IP your SQL Server sends from.
  4. Change the account: Server name your MX host (for example contoso-com.mail.protection.outlook.com), Port number 25, SMTP Authentication Anonymous authentication. Scripting it? In sysmail_add_account_sp, @port = 25 and @username = NULL means no authentication (Microsoft Learn).
  5. Set E-mail address to an address in a domain your tenant owns, or Microsoft 365 rejects the message (see 550 5.7.64 TenantAttribution).
  6. Right-click Database Mail → Send Test E-Mail. If nothing happens, check EXEC msdb.dbo.sysmail_help_status_sp; and start it with EXEC msdb.dbo.sysmail_start_sp;, then read sysmail_event_log again.
  7. Azure SQL Managed Instance: SQL Agent mail must use the profile AzureManagedInstance_dbmail_profile, and the SMTP port needs an outbound rule in the instance's network security group (Microsoft Learn). The relay connector needs a static IP that you control; how that maps to Managed Instance outbound traffic is not documented.

If it can't do OAuth

  1. No static IP for a relay connector? Point Database Mail at a local SMTP relay on your network that signs in to Microsoft 365 itself. Microsoft's Managed Instance guide recommends an authenticated SMTP relay service and suggests one already in your on-premises servers.
  2. Without a connector, the MX host on port 25 is direct send, which only reaches mailboxes inside your organization (Microsoft Learn). Fine for a DBA team mailbox, not for outside recipients. See 550 5.7.68 if direct send is blocked in your tenant.
  3. Don't use Windows Authentication using Database Engine service credentials for Microsoft 365: Microsoft says it is only available with Exchange on-premises.
  4. Stopgap only: an admin can turn Basic auth for SMTP AUTH back on for now. It ends when Microsoft removes it for good; the date is due in the second half of 2027. See the SMTP AUTH change.
Wizard path (SSMS)Object Explorer > Management > Database Mail > Configure Database Mail
SMTP Authentication optionsWindows Authentication using Database Engine service credentials, Basic Authentication, Anonymous authentication
OAuth / XOAUTH2Not documented (no OAuth option in the wizard or in sysmail_add_account_sp)
Relay connector valuesServer name: your MX host, Port number: 25, SMTP Authentication: Anonymous authentication
T-SQL account parameters@mailserver_name, @port (default 25), @username (NULL = no authentication), @password, @use_default_credentials, @enable_ssl
Logs and viewsmsdb.dbo.sysmail_event_log, sysmail_faileditems, sysmail_unsentitems, sysmail_sentitems, sysmail_allitems
Retry defaultsAccount Retry Attempts 5, Account Retry Delay 60 seconds
Azure SQL Managed InstanceSQL Agent profile must be named AzureManagedInstance_dbmail_profile; outbound NSG rule for the SMTP port
Azure SQL DatabaseDatabase Mail not available

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Sources

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other devices and apps