Microsoft 365: connect with Microsoft sign-in
Connect Exchange Online mailboxes with OAuth (recommended) or SMTP AUTH, and what to do when consent is blocked.
For Microsoft 365 mailboxes use Connect with Microsoft: you sign in with Microsoft and grant permission to send and read mail. No password is stored; the tokens are encrypted and refreshed automatically.
Permissions requested
| Permission | Used for |
|---|---|
User.Read | Identify the signed-in mailbox |
Mail.Send | Send campaign emails and replies |
Mail.ReadWrite | Read replies and bounces; move warm-up mail out of junk |
offline_access | Keep the connection working without signing in again |
openid, email, profile | Sign-in basics |
"Admin approval required"
Many organizations don't let users consent to third-party apps. Then Microsoft shows "Need admin approval". A Global Administrator (or Cloud Application Administrator) can grant consent for the organization in the Microsoft Entra admin center (Enterprise applications → the app → Permissions → Grant admin consent), or approve the request if your tenant uses the admin consent workflow.
The mailbox needs Exchange Online
The connection test reads the inbox through Microsoft Graph. A user without an Exchange Online licence (or a shared mailbox without a licence) fails with "mailbox not enabled".
When the connection breaks
A password reset, revoked consent, a new MFA or Conditional Access policy can invalidate the connection. The account then shows Reconnect required and stops sending; use Reconnect with Microsoft on the account's Connection tab.
Alternative: SMTP AUTH
If Microsoft sign-in isn't configured on your installation, choose Microsoft 365 (SMTP AUTH): SMTP smtp.office365.com port 587 (STARTTLS) and IMAP outlook.office365.com port 993. SMTP AUTH must be enabled for the mailbox in the Microsoft 365 admin center (the error mentions 5.7.139 otherwise). Microsoft is retiring basic authentication, so prefer OAuth.
For administrators of a self-hosted installation
Register an app in Microsoft Entra (App registrations): Web redirect URI https://<your app domain>/api/oauth/microsoft/callback, a client secret, and the delegated Graph permissions above. Set MICROSOFT_CLIENT_ID and MICROSOFT_CLIENT_SECRET; the Connect with Microsoft button appears automatically. Becoming a verified publisher avoids consent being blocked in many tenants.