Fixing "SmtpClientAuthentication is disabled for the Mailbox" in Outlook

If you send from an Outlook or Microsoft 365 mailbox through another app, sooner or later you may see this:

535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Mailbox.

Your password is fine. The error means the mailbox isn't allowed to send through SMTP sign-in at all.

What the error means

Apps that send through Outlook usually use SMTP AUTH (also called client submission) on smtp.office365.com, port 587. Microsoft lets administrators turn SMTP AUTH off for a whole organisation or for individual mailboxes, and it's off by default in many Microsoft 365 organisations because it's a common target for attackers.

The last word of the error tells you where it's blocked:

• "…disabled for the Mailbox": switched off for this one mailbox
• "…disabled for the Tenant": switched off for the whole organisation

The same 5.7.139 code can also appear when security defaults or Conditional Access block the sign-in, even if SMTP AUTH itself is on.

Why this keeps happening

Microsoft has been moving everyone away from password-based sign-in for email:

• Personal Outlook.com accounts (including Hotmail and Live) stopped accepting passwords and app passwords from mail apps in September 2024. Apps must use Microsoft sign-in (OAuth) instead.
• Microsoft 365 is retiring basic authentication for SMTP AUTH. After several delays, Microsoft's latest timeline turns it off by default for existing organisations at the end of December 2026, with a final removal date to follow.

OAuth sign-in still uses SMTP AUTH, so even apps that have moved to OAuth hit this error when SMTP AUTH is disabled for the mailbox.

Fix 1: turn SMTP AUTH on for the mailbox (admins)

If you manage the Microsoft 365 organisation, you can enable SMTP AUTH for just the mailboxes that need it:

1. Open the Microsoft 365 admin center and go to Users, then Active users.
2. Choose the user, open the Mail tab and select Manage email apps.
3. Turn on Authenticated SMTP and save.

Or with Exchange Online PowerShell:

Set-CASMailbox -Identity user@yourdomain.com -SmtpClientAuthenticationDisabled $false

A mailbox setting overrides the organisation setting, so prefer enabling it per mailbox rather than for everyone. Changes can take a while to apply.

Fix 2: send through Microsoft Graph instead

Microsoft Graph is Microsoft's modern API for mail. Its sendMail endpoint doesn't use SMTP at all, so it works even when SMTP AUTH is disabled. It needs the user to approve the Mail.Send permission when they sign in.

This is the better long-term option: there's nothing for an administrator to switch back on, and it doesn't depend on a protocol Microsoft is phasing out.

Fix 3: check sign-in policies

If SMTP AUTH is already on and the error remains, look at security defaults and Conditional Access policies in Microsoft Entra ID. They can block the sign-in before SMTP is even considered.

How Mailnitrix handles it

You don't have to choose. When you connect an Outlook or Microsoft 365 mailbox, the single Microsoft sign-in asks for both SMTP sending and Graph's Mail.Send permission. If the mailbox ever returns "SmtpClientAuthentication is disabled", Mailnitrix switches it to Microsoft Graph, retries the email and keeps using Graph for that mailbox from then on. Nothing else changes.

Read more about Outlook and Microsoft 365 in Mailnitrix, or follow the setup guide.