Zabbix email media type with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: Zabbix 7.4 can sign in to Microsoft 365 with OAuth: set the email media type to Email provider Office365 and Authentication OAuth, then enter a client ID and secret. Zabbix 7.0 has no OAuth option, so use the Office365 relay provider with a relay connector, or upgrade.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Zabbix added OAuth 2.0 for SMTP in 7.4. In 7.0 the Authentication field offers only None and Username and password, so a 7.0 media type that logs in to Office365 with a password breaks when the Basic auth switch-off reaches your tenant. With OAuth, Zabbix still uses SMTP AUTH, but with a token: its Office365 defaults request https://outlook.office.com/SMTP.Send and offline_access through the authorization code grant at https://login.microsoftonline.com/common/oauth2/v2.0/authorize. You enter only the Redirection endpoint, Client ID and Client secret. Zabbix says SmtpClientAuthentication must be enabled for the mailbox or the tenant. OAuth isn't supported for the Office365 relay provider. How to set up the Microsoft Entra app (account type, platform, permission type): not documented by Zabbix.

What you will see when it breaks

Best fix

  1. Check your version and the media type: Alerts → Media types → Email. Zabbix 7.0 can only log in with Username and password, which fails once Microsoft turns Basic auth off by default at the end of December 2026. Our free, read-only SMTP AUTH sender script lists every SMTP AUTH sender in your tenant, so you can find the mailbox Zabbix uses.
  2. Keep SMTP AUTH on for that mailbox, because OAuth still goes through SMTP AUTH: Set-CASMailbox -Identity zabbix@yourdomain.com -SmtpClientAuthenticationDisabled $false.
  3. Register an app in Microsoft Entra (App registrations → New registration). Add the Zabbix Redirection endpoint, https://<zabbix-frontend-url>/zabbix.php?action=oauth.authorize, as a redirect URI and create a client secret. Give it the SMTP.Send permission that Microsoft Learn lists for SMTP AUTH. Zabbix's defaults use the /common endpoint, which Microsoft rejects for single-tenant apps (AADSTS50194), so register the app as multitenant. Which redirect platform type to choose: not documented by Zabbix.
  4. Edit the media type: Email provider: Office365, Email = the sending mailbox, Authentication: OAuth. Next to OAuth tokens click Configure, check the Redirection endpoint and enter the Client ID and Client secret. Zabbix fills in the other values.
  5. Submit. A browser popup opens Microsoft's sign-in page; sign in as the sending mailbox and accept. Zabbix exchanges the code for access and refresh tokens. If that fails, set Authorization code to Manual and paste the code.
  6. Single-tenant app only (our suggestion, not covered by Zabbix): Zabbix says the Generic SMTP form can also set up OAuth for Office365. There you enter the endpoints yourself, so you can put your tenant ID in place of common, as Microsoft's AADSTS50194 message suggests.
  7. Click Test in the media type list and send a test message. Note that Zabbix exports the client secret in clear text when you export the media type.

If it can't do OAuth

  1. Zabbix 7.0, or OAuth not allowed in your tenant? Use the Office365 relay provider with an SMTP relay connector. It needs no password: Zabbix builds the server name from the sender's domain (example-com.mail.protection.outlook.com). The connector must trust the Zabbix server's static public IP or a certificate.
  2. Zabbix server in Azure or another third-party cloud? Microsoft says relay can't be used from there. Upgrade to 7.4 and use OAuth.
  3. Stopgap only: a password login needs SMTP AUTH on for the mailbox and Basic auth still allowed. After the end of December 2026 admins can turn Basic auth back on until a final removal date, which Microsoft will announce in the second half of 2027. Details: Basic auth retirement.
MenuAlerts > Media types > Email (or Create media type)
Email providerOffice365 (password or OAuth) or Office365 relay (no password, no OAuth)
AuthenticationZabbix 7.4: None, Username and password, OAuth. Zabbix 7.0: None, Username and password
Redirection endpointhttps://<zabbix-frontend-url>/zabbix.php?action=oauth.authorize
Office365 OAuth defaultsAuthorize: https://login.microsoftonline.com/common/oauth2/v2.0/authorize; token: https://login.microsoftonline.com/common/oauth2/v2.0/token; scope: https://outlook.office.com/SMTP.Send, offline_access; grant: authorization_code
SMTP server, port, securityFilled in by Zabbix and hidden; shown in the Details column of the media type list
Mailbox requirementSMTP AUTH (SmtpClientAuthentication) enabled for the mailbox or the tenant
Office365 relay server<your domain with dashes>.mail.protection.outlook.com, built from the sender address
Entra app registration detailsNot documented by Zabbix

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Sources

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other devices and apps