How to Check SMTP AUTH is Enabled or Disabled in Microsoft 365

Deprecation of Basic authentication in Exchange Online

In September 2021, Microsoft announced that effective October 1, 2022, they will begin disabling Basic authentication for Outlook, EWS, RPS, POP, IMAP, and EAS protocols in Exchange Online. SMTP Auth will also be disabled if it is not being used. See full announcement: Basic Authentication and Exchange Online – September 2021 Update.

The SMTP AUTH protocol is used for client SMTP email submission, typically on TCP port 587. In some cases, when you sent an email using SMTP Auth, you got the error:

Send-MailMessage : The SMTP server requires a secure connection, or the client was not authenticated. The server response was: 5.7.57 Client not authenticated to send mail. Error: 535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant.

Disable or Enable SMTP AUTH in your organization

Microsoft highly recommend that you keep SMTP AUTH disabled in your organization. You should only enable it for the mailboxes that still require it.

1. Connect to Exchange Online PowerShell or you can open Windows PowerShell (Admin) then run below commands:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force;
Install-PackageProvider -Name NuGet -Force;
Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted;
Install-Module -Name ExchangeOnlineManagement;
Import-Module ExchangeOnlineManagement;
Connect-ExchangeOnline;

2. Run the following command to check SMTP AUTH status:

Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

SmtpClientAuthenticationDisabled property is True means the SMTP AUTH is already disabled

PS C:\> Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

SmtpClientAuthenticationDisabled : True

3. Run the following command to enable SMTP AUTH:

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Note: To disable SMTP AUTH if it’s already enabled, use the value $true.

Enable SMTP AUTH for specific mailboxes

Microsoft highly recommend that you disable SMTP AUTH in your Exchange Online organization, and enable it only for the accounts (that is, mailboxes) that still require it.

Note Note: You must disable Security Defaults in Azure Active Directory, when it enabled, it’ll disable basic authentication in whole tenant, and it overwrites all other settings. It means enable SMTP Authentication will not work.

1. Run the following command to enable SMTP Authentication for a specific mailbox.

Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false

2. To verify that you’ve enabled or disabled SMTP AUTH for a specific mailbox, you can check it through Microsoft admin center or using PowerShell.

PS C:\> Get-CASMailbox -Identity [email protected]  | FL SmtpClientAuthenticationDisabled

SmtpClientAuthenticationDisabled : False

Or you can use the following command with SmtpClientAuthenticationDisabled property:

False = Enable SMTP Authentication.
True = Disable SMTP Authentication.
blank = Use organization setting.

Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled
Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false
Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $true

Alternatively, for individual mailbox in the Microsoft 365 admin center:

Go to Users > Active users > Select the user > click Mail > click Manage email apps and verify the value of Authenticated SMTP (checked = enabled, unchecked = disabled).

To get all mailboxes where SMTP AUTH is enabled, run the following command:

$Users = Get-CASMailbox -ResultSize unlimited
$Users | where {$_.SmtpClientAuthenticationDisabled -eq $false} | 
Select-Object DisplayName,PrimarySmtpAddress

PS C:\Users\admin> $Users = Get-CASMailbox -ResultSize unlimited
PS C:\Users\admin> $Users | where {$_.SmtpClientAuthenticationDisabled -eq $false} |
>> Select-Object DisplayName,PrimarySmtpAddress

DisplayName PrimarySmtpAddress
----------- ------------------
Chris       [email protected]
David       [email protected]
Maria       [email protected]
Tonny       [email protected]

To get all mailboxes where SMTP AUTH is controlled by the organization setting, run the following command:

$Users = Get-CASMailbox -ResultSize unlimited
$Users | where {$_.SmtpClientAuthenticationDisabled -eq $null} | 
Select-Object DisplayName,PrimarySmtpAddress

PS C:\Users\admin> $Users = Get-CASMailbox -ResultSize unlimited
PS C:\Users\admin> $Users | where {$_.SmtpClientAuthenticationDisabled -eq $null} |
>> Select-Object DisplayName,PrimarySmtpAddress

DisplayName              PrimarySmtpAddress
-----------              ------------------
Bon Ben                  [email protected]
Anna                     [email protected]
Ben                      [email protected]
Chris                    [email protected]
...