Synology DSM and QNAP QTS / QuTS hero email notifications with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: Synology DSM and QNAP Notification Center both have an Outlook sign-in option (OAuth) for alert email. Use it instead of a custom SMTP server with smtp.office365.com and a password, which fails once Basic auth is off. A relay connector on port 25 is the fallback.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Synology: in DSM the notification sender can use Outlook as the service provider with a Sign In button. Since DSM 7.1.1-42962 Update 2 (October 2022; also DSM 7.0.1-42218 Update 6 and DSM 6.2.4-25556 Update 7) the Outlook option requires OAuth 2.0, and Outlook senders set up before that update were moved to Custom SMTP server, which logs in with a password. Those NASes will hit the Basic auth switch-off. QNAP: Notification Center's Outlook provider signs in through a Microsoft window (Add account, then Allow) and has a Re-authorization button when access expires. Neither vendor says whether Microsoft 365 work or school accounts are supported (QNAP's FAQ calls the service Outlook.com), which Microsoft permissions are requested, or whether tenant admin consent is needed: not documented.

What you will see when it breaks

Best fix

  1. See how the NAS sends today. Synology: Control Panel → Notification → Email. QNAP: Notification Center → Service Account and Device Pairing → E-mail. A custom SMTP entry with smtp.office365.com and a password is Basic auth and will break.
  2. Synology: set the sender up again with Service provider: Outlook, click Sign In and sign in with the Microsoft 365 mailbox that should send the alerts. Do this even if the NAS once used Outlook: older Outlook senders were moved to Custom SMTP server.
  3. QNAP: click Add SMTP Service, choose Outlook, click Add account, sign in with the sending mailbox and click Allow. Tick Set as default SMTP service account (system notifications use the default), then Create. Remove the old Custom entry and add the new one to your notification rules.
  4. Send a test email from the same screen on both systems.
  5. If Microsoft's sign-in page says the app needs admin approval, a Microsoft 365 admin has to grant it. Synology and QNAP don't document this step.
  6. QNAP only: when you see Authorization has expired, edit the SMTP service and click Re-authorization, or remove the service and add it again.

If it can't do OAuth

  1. Create an SMTP relay connector in the Exchange admin center (Mail flow → Connectors, connection from Your organization's email server to Office 365) that trusts your office's static public IP.
  2. Synology: Service provider: Custom SMTP server, SMTP server = your MX host (for example contoso-com.mail.protection.outlook.com), port 25, untick Authentication required, sender = any address in your domain.
  3. QNAP: choose Custom with the MX host and port 25. QNAP's form shows username and password fields and doesn't say they can be left empty: not documented. If it won't save without them, use the Outlook option or a third-party SMTP service instead.
  4. Add the office IP to your SPF record with the SPF generator, then check the domain with our checker.
  5. Stopgap only: an admin can turn SMTP AUTH back on for the NAS mailbox (Set-CASMailbox -Identity nas@yourdomain.com -SmtpClientAuthenticationDisabled $false) until Microsoft removes Basic auth for good. See 535 5.7.139.
Synology menuControl Panel > Notification > Email
Synology OAuth optionService provider: Outlook, then Sign In (OAuth 2.0)
QNAP menuNotification Center > Service Account and Device Pairing > E-mail > Add SMTP Service
QNAP OAuth optionOutlook: Add account, sign in, Allow; Re-authorization when it expires
Relay: SMTP serverYour MX host, e.g. contoso-com.mail.protection.outlook.com
Relay: port and loginPort 25, no username or password (Synology: untick Authentication required; QNAP: empty login not documented)
Relay: encryptionTLS on if the NAS supports it; Microsoft lists TLS as optional for relay. Whether DSM or QTS use STARTTLS on port 25: not documented

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Sources

Other devices and apps