Enable SMTP AUTH in Microsoft 365

Microsoft disables Authenticated SMTP (SMTP AUTH) by default on most Microsoft 365 tenants. Until an admin turns it on for a mailbox, anything sending through that mailbox over SMTP is refused at authentication. Enabling it takes about two minutes per mailbox in the Microsoft 365 admin center.

In Vetta you need it in two cases: to warm up a Microsoft 365 or Outlook mailbox with Vetta's warm-up, and to connect a Microsoft 365 mailbox over IMAP/SMTP. A mailbox connected with Connect with Microsoft (the Microsoft sign-in) sends through Microsoft's own connection instead, so it does not need SMTP AUTH to send your sequences.

This is a setting on Microsoft's side, not in Vetta. You only need to do it once per mailbox.

Before you start

• You need Global Administrator or Exchange Administrator rights on the tenant. A regular user cannot change this setting on their own mailbox.
• The mailbox has to be hosted in Exchange Online. On-premises and hybrid mailboxes are governed by your own Exchange server instead.
• The setting is per mailbox, not per domain. Repeat it for every mailbox you plan to send from.

Enable Authenticated SMTP for a mailbox

1. Sign in to the Microsoft 365 admin center as an admin
2. Go to Users → Active users
3. Select the user whose mailbox you want to warm up or connect
4. Open the Mail tab in the panel that opens
5. Under Email apps, click Manage email apps
6. Tick Authenticated SMTP, and leave IMAP ticked too, so warm-up can read the replies it receives
7. Click Save changes

The change usually applies within a few minutes, though Microsoft can take up to an hour to propagate it across the tenant. If the mailbox is already connected to Vetta, reconnect it afterwards so the new permission is picked up.

If Authenticated SMTP is greyed out or will not stay on

Three tenant-level settings override the per-mailbox toggle. Check them in this order.

Security defaults are enabled. Security defaults block legacy authentication across the whole tenant, and SMTP AUTH is covered by that block. You will find the switch in the Microsoft Entra admin center under Properties → Manage security defaults.

SMTP AUTH is disabled organization-wide. In the Exchange admin center, go to Settings → Mail flow and check Turn off SMTP AUTH protocol for your organization. The per-mailbox setting takes precedence over the organization setting, so a mailbox you explicitly enabled will still work, but leaving the org-wide block in place is what causes mailboxes to "lose" the setting later.

An authentication policy blocks basic authentication for SMTP. If your tenant has an authentication policy that disables basic auth for SMTP, clients cannot use the protocol even with everything above enabled. SMTP AUTH itself supports OAuth as well as basic authentication, so the fix is usually to allow the mailbox in the policy rather than to weaken it tenant-wide.

Doing it in PowerShell

Connect to Exchange Online PowerShell, then enable a single mailbox:

Set-CASMailbox -Identity "sales@yourdomain.com" -SmtpClientAuthenticationDisabled $false

Check that it worked. False means SMTP AUTH is enabled, True means disabled, and blank means the mailbox follows the organization setting:

Get-CASMailbox -Identity "sales@yourdomain.com" | Format-List SmtpClientAuthenticationDisabled

Enable a list of mailboxes at once, one address per line in the text file:

$Allow = Get-Content "C:\mailboxes.txt"
$Allow | foreach {Set-CASMailbox -Identity $_ -SmtpClientAuthenticationDisabled $false}

To lift an organization-wide block:

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Microsoft 365 SMTP settings

If you are asked for server details, these are Microsoft's:

• Server: smtp.office365.com
• Port: 587
• Encryption: STARTTLS
• Username: the full email address of the mailbox

Connect the mailbox to Vetta

With Authenticated SMTP on, connect the mailbox where you need it:

• For warm-up: in Settings > Workspace > Email Infrastructure, click Warm-up, then Add mailbox and choose Office 365 / Outlook. Sign in to authorise warm-up.
• For sending over IMAP/SMTP: under Settings → Core Integrations → Add Email, choose Connect via IMAP/SMTP and enter the Microsoft settings above. IMAP/SMTP connections sync email only, with no calendar.

If you would rather not enable SMTP AUTH, choose Connect with Microsoft instead: it signs in with your Microsoft account, sends without SMTP and syncs your calendar too. The full walkthrough is in Integrate your Email & calendar.

Two things to do before the mailbox carries real outbound:

• Warm it up. A mailbox that goes from zero to sequence volume on day one lands in spam. See Mailbox warm-up and deliverability.
• Keep Global Sending Limits at the recommended values. They count per mailbox, so spread volume across mailboxes rather than maxing one out. See Configuring communication steps.

Common questions

Key outcome

Authenticated SMTP is the switch that decides whether a Microsoft 365 mailbox can send over SMTP at all. Turn it on for each mailbox you warm up or connect over IMAP/SMTP, confirm no tenant-level policy is overriding it, then warm the mailbox up before pointing sequences at it.