WordPress SMTP plugins (WP Mail SMTP, FluentSMTP, Post SMTP) with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: Move the plugin off Other SMTP (smtp.office365.com plus a password) to its Microsoft mailer: WP Mail SMTP 365 / Outlook (Pro), FluentSMTP Outlook (free) or Post SMTP Office 365 (Pro). They send through Microsoft Graph with OAuth, so the Basic auth switch-off doesn't touch them.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

All three plugins can send through Microsoft's API with OAuth 2.0, so WordPress stores no mailbox password and the SMTP AUTH Basic auth change doesn't affect them. WP Mail SMTP's 365 / Outlook mailer uses the Microsoft Graph API and needs a Pro licence or higher; its docs name only the mail.readwrite scope (used for large attachments), the rest of its permission list is not documented. FluentSMTP's free Outlook / Office 365 connection lists no permissions in its docs, but its source code calls Graph /me/sendMail and requests the delegated scopes Mail.Send, Mail.Send.Shared and offline_access. Post SMTP's Office 365 mailer (Pro) authenticates against Microsoft's Graph API; its permission names are not documented. All three need a Microsoft Entra app registration, except WP Mail SMTP One-Click Setup (Pro) and Post SMTP One-Click (Business plan), where you only sign in with Microsoft.

What you will see when it breaks

Reported: 535 5.7.139 Authentication unsuccessful, basic authentication is disabled. (quoted in a WP Mail SMTP blog post for sites using Other SMTP with smtp.office365.com)
"535 5.7.3 Authentication unsuccessful" (Microsoft Learn: the failed SMTP AUTH password login as many apps report it)
"SMTP Error: MailboxNotEnabledForRESTAPI" (WP Mail SMTP docs: the mailbox can't use the API, for example an on-premises mailbox in a hybrid setup)
"Error: InvalidAuthenticationToken: Token Expired" (WP Mail SMTP docs: remove the connection and authorise again)
"SMTP Error: ErrorSendAsDenied" (WP Mail SMTP docs: the From Email isn't the mailbox you authorised)
Error code 403 after Post SMTP One-Click sign-in (Post SMTP docs: you signed in with an account other than the From Email)

Best fix

Check which mailer the plugin uses. Other SMTP with smtp.office365.com, port 587 and a password is Basic auth and will fail once Microsoft switches it off at the end of December 2026.
Pick the plugin's Microsoft mailer: WP Mail SMTP 365 / Outlook (Pro licence), FluentSMTP Outlook / Office 365 (free), or Post SMTP Office 365 (Pro; activate it first under Post SMTP → Extensions).
Fastest route: WP Mail SMTP One-Click Setup (Pro) or Post SMTP One-Click (Business plan). You sign in with Microsoft and skip the app registration.
Otherwise register an app: Azure portal or Microsoft Entra admin center → App registrations → New registration. All three guides use Accounts in any organizational directory … and personal Microsoft accounts. Set the Redirect URI platform to Web and paste the URI the plugin shows (FluentSMTP: https://yourdomain.com/wp-json/fluent-smtp/outlook_callback). Then Certificates & secrets → New client secret and copy the Value, not the Secret ID.
Paste the Application (client) ID and the secret Value into the plugin and click its connect button (WP Mail SMTP: Allow plugin to send emails using your Microsoft account; FluentSMTP: Authenticate with Office365; Post SMTP: Connect to Office 365). Accept Microsoft's permission prompt. If your tenant blocks user consent, a Global Administrator has to approve the app.
Sign in with the mailbox you send from and use that address as the From Email (in WP Mail SMTP, turn on Force From Email). Send the plugin's test email.
Write down the client secret's expiry date (WP Mail SMTP suggests 730 days, Post SMTP 24 months) and create a new secret before it runs out.

If it can't do OAuth

Can't use Microsoft's API (for example MailboxNotEnabledForRESTAPI on a hybrid mailbox)? Switch the plugin to a third-party email service with its own login or API key, then add its SPF include with the SPF generator and check the domain with our checker.
A relay connector is usually not an option for WordPress: Microsoft says SMTP relay can't be used from mail sent by a third-party hosted service (for example Azure), and most WordPress sites run on hosting like that.
Stopgap only: an admin can turn SMTP AUTH back on for the site's mailbox with Set-CASMailbox -Identity wordpress@yourdomain.com -SmtpClientAuthenticationDisabled $false. It stops working when Microsoft removes Basic auth for good. Details: 535 5.7.139.

Microsoft mailer	`WP Mail SMTP Pro: 365 / Outlook. FluentSMTP (free): Outlook / Office 365. Post SMTP Pro: Office 365`
How it sends	`Microsoft Graph API with OAuth 2.0; no SMTP server, port or password`
Entra app: supported account types	`Accounts in any organizational directory (multitenant) and personal Microsoft accounts; single tenant works if you give the plugin your tenant ID`
Entra app: redirect URI	`Platform Web; copy the URI from the plugin settings`
Entra app: client secret	`Copy the Value; WP Mail SMTP suggests 730 days, Post SMTP 24 months`
Permissions	`FluentSMTP (source code): delegated Mail.Send, Mail.Send.Shared, offline_access. WP Mail SMTP: only mail.readwrite documented. Post SMTP: not documented`
No app registration needed	`WP Mail SMTP One-Click Setup (Pro or higher); Post SMTP One-Click (Business plan)`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)