Veeam Backup & Replication email notifications with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: Switch the Veeam mail server from SMTP server (smtp.office365.com plus a password) to Microsoft 365 OAuth 2.0: Options → Email Settings, Mail server Microsoft 365, Authorize now. Veeam then signs in with a token, so the Basic auth switch-off doesn't affect it.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Veeam Backup & Replication supports three mail server methods: SMTP basic authentication, Google Gmail OAuth 2.0 and Microsoft 365 OAuth 2.0. The v12 guide (build 12.3.2) and the v13 guide both document the Microsoft 365 option. Only SMTP basic authentication logs in with a password, so only it is hit by the SMTP AUTH Basic auth switch-off. With Microsoft 365 you sign in once with an Exchange Online account, Veeam shows Token is valid and refreshes the token automatically. You can use Veeam's default app or your own Microsoft Entra app; the v13 web UI asks for your own app's client ID, tenant ID and client secret. Veeam's guide for your own app grants the Microsoft Graph application permission Mail.Send with admin consent, so that Veeam can call the Microsoft Graph API to send notifications. Microsoft Learn says this permission lets an app send mail as any user. Which permissions Veeam's default app requests: not documented.

What you will see when it breaks

Best fix

  1. Check how Veeam sends today: main menu → Options → Email Settings (v13 web UI: Configuration → Email Settings). Mail server: SMTP server with smtp.office365.com and This SMTP server requires authentication ticked is Basic auth. Microsoft turns Basic auth off by default at the end of December 2026. Our free, read-only SMTP AUTH sender script lists every mailbox that still sends this way, including the one Veeam uses.
  2. Use a dedicated mailbox for alerts: Veeam recommends a dedicated service account with granular SendMail permissions. On the Veeam server, turn off Internet Explorer Enhanced Security Configuration in Server Manager; Veeam says this is needed to sign in with Exchange Online credentials.
  3. Console: in Mail server pick Microsoft 365, click Authorize now and sign in with the alert mailbox. Wait for the Token is valid notice.
  4. v13 web UI: click Configure next to Mail server, choose Microsoft 365 (modern authentication), enter the application client ID, tenant ID and client secret, then click Authorize and sign in.
  5. Your own app (needed for the web UI; optional in the console under Advanced → Use custom application registration settings, which takes the client ID and tenant ID): Microsoft Entra ID → App registrations → New registration, Accounts in this organizational directory only. Under Authentication add Mobile and desktop applications with the redirect URIs msal<client ID>://auth, ms-appx-web://microsoft.aad.brokerplugin/<client ID> and http://localhost. Under API permissions add Microsoft Graph → Application permissions → Mail.Send and click Grant admin consent. When you authorize, tick Consent on behalf of your organization. How to create the client secret the web UI asks for: not documented in Veeam's guide.
  6. Set From to the mailbox you signed in with (Veeam requires this for OAuth), then click Test Message.
  7. If the token is revoked or the mailbox password changes, click Re-authorize.

If it can't do OAuth

  1. No Microsoft 365 option in your Veeam version? Create an SMTP relay connector that trusts the Veeam server's static public IP. Then set Mail server: SMTP server to your MX host (for example contoso-com.mail.protection.outlook.com) and under Advanced use port 25, untick This SMTP server requires authentication and tick Connect using SSL. Port 465 (implicit TLS) is not supported.
  2. HA cluster: Veeam sends from the IP address of the current primary node, not the cluster IP. Add both node IPs to the connector.
  3. Stopgap only: a password login needs SMTP AUTH on for the mailbox (Set-CASMailbox -Identity veeam@yourdomain.com -SmtpClientAuthenticationDisabled $false) and Basic auth still allowed. After the end of December 2026 admins can turn Basic auth back on until a final removal date, which Microsoft will announce in the second half of 2027. Details: Basic auth retirement.
Menu (console)Main menu > Options > Email Settings > Enable email notifications
Menu (v13 web UI)Configuration > Email Settings > Configure next to Mail server
Mail server (OAuth)Console: Microsoft 365, then Authorize now. Web UI: Microsoft 365 (modern authentication), then Authorize
From addressThe mailbox you signed in with
Own app: account typeAccounts in this organizational directory only
Own app: redirect URIsMobile and desktop applications: msal<client ID>://auth, ms-appx-web://microsoft.aad.brokerplugin/<client ID>, http://localhost
Own app: permissionMicrosoft Graph application permission Mail.Send, admin consent granted
Own app: values in VeeamConsole: client ID and tenant ID. v13 web UI: client ID, tenant ID and client secret
Default app permissionsNot documented
Relay fallbackSMTP server = MX host, port 25, no authentication, Connect using SSL; port 465 not supported

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Sources

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other devices and apps