Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →To send WordPress mail through Office 365, connect an SMTP/OAuth mailer plugin to a licensed Microsoft 365 mailbox. Use Microsoft’s client-submission server settings, authorize the mailbox with OAuth 2.0, and make the WordPress From address match the authenticated mailbox or an address it is permitted to send as. This avoids the most common authentication, TLS, and 5.7.60 sender errors.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The procedure below covers tenant preparation, Entra app consent, WordPress configuration, testing, security, and the limits that matter when a site sends many messages.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteOffice 365 SMTP settings WordPress needs
Enter the following values in your SMTP plugin when it asks for manual server details. OAuth 2.0 is preferable to a stored mailbox password.
| Setting | Value | Important qualification |
|---|---|---|
| SMTP host | smtp.office365.com |
Use this DNS name, not an IP address. |
| Port | 587 |
Microsoft recommends this client-submission port. Port 25 is also supported for client submission in Microsoft’s current guidance. |
| Encryption | TLS/STARTTLS | The server connection must negotiate modern TLS; use TLS 1.2 or 1.3 where your host exposes a protocol choice. |
| Authentication | OAuth 2.0 (Modern Authentication) | Microsoft recommends OAuth. Choose a password field only when your organization has explicitly approved that arrangement and the tenant still permits it. |
| Username or mailbox | The licensed Microsoft 365 mailbox authorized for WordPress | The mailbox must be allowed to use SMTP AUTH and must have permission to use the From address. |
| From address | The authenticated mailbox, or an address for which it has Send As permission | An unapproved alternate sender can produce a 5.7.60 nondelivery error. |
Do not substitute port 465 for this setup. Microsoft’s client-submission requirements do not treat 465 as the appropriate port, and using an IP address instead of the Microsoft 365 DNS name can prevent a connection or certificate validation.
What you need before changing WordPress
- Administrator access to WordPress: You need to install and configure a maintained SMTP mailer plugin.
- A licensed mailbox: A dedicated mailbox for site notifications keeps website traffic separate from a person’s inbox and makes ownership clear when staff change.
- Microsoft 365 administration rights: An administrator may need to check organization-wide and mailbox-level SMTP AUTH settings and approve an Entra application’s permissions.
- Outbound access from the web host: Your hosting provider or firewall must allow a TLS connection to the configured client-submission port.
- An external test inbox: Use an address outside the Microsoft 365 tenant as well as an internal address, because internal delivery can succeed while external delivery is filtered or rejected.
- A sender decision: Decide whether every message will come from the dedicated mailbox or from a shared address. If it is a shared address, arrange Send As permission before testing.
Organizations created after January 2020 generally have SMTP AUTH disabled unless an administrator enables it for the required mailbox. Security policy can also disable it at the tenant level, so a valid password or OAuth consent alone does not prove that SMTP submission is available.
Choose a maintained WordPress SMTP plugin
WordPress does not provide a complete Microsoft 365 OAuth mailer in core. A plugin supplies the authorization flow, transports WordPress mail over SMTP, and usually adds a test tool and diagnostics. Select one that is actively maintained and whose current documentation clearly explains Microsoft 365 OAuth.
| Evaluation point | Why it matters | Questions to ask before installing |
|---|---|---|
| OAuth 2.0 and consent flow | OAuth avoids putting a mailbox password in WordPress and is Microsoft’s recommended authentication model. | Does the plugin support Microsoft Entra authorization, show the redirect URI, and explain which SMTP permission it requests? |
| Test email | A controlled test distinguishes WordPress configuration problems from recipient-side filtering. | Can you send to an arbitrary address and see the server response? |
| Mail logs | Diagnostic records preserve the exact SMTP error, recipient, and time needed for troubleshooting. | Are logs available per site, and can sensitive message content be limited or removed? |
| Secret protection | Client IDs, secrets, refresh tokens, and mailbox credentials are high-value data. | Are secrets encrypted at rest, excluded from normal page output, and removable when access is revoked? |
| Multisite support | Network installations may need one controlled configuration or separate site-level settings. | Can a network administrator enforce a single From address and prevent individual sites from replacing it? |
| Fallback mailers | A second supported transport can help isolate a Microsoft 365 outage, but it also creates another credential set to secure. | Is fallback documented, and can it be disabled without silently changing the sender? |
| Maintenance cadence | OAuth integrations and Microsoft security policies change over time. | When was the plugin last updated, and does its documentation identify current Microsoft 365 behavior? |
Several plugins document Microsoft 365 support, but their capabilities differ. NimblyMail documents Azure OAuth endpoints; Prostylemedia SMTP documents encrypted local secret storage and configurable SMTP; DixonSMTP documents an OAuth-only approach and troubleshooting guidance. Treat those statements as feature descriptions to verify against the release you install, not as a guarantee that every version exposes the same screens.
Prepare Microsoft 365 and SMTP AUTH
Check the tenant and mailbox policy
Ask a Microsoft 365 administrator to verify that SMTP AUTH is allowed for the organization and for the specific sending mailbox. A tenant-level prohibition overrides a mailbox setting. If the organization’s security policy permits SMTP submission, enable it only for the dedicated mailbox rather than broadly relaxing authentication for every account.
The administrator should also confirm that the mailbox is licensed and can sign in. A disabled, unlicensed, or blocked mailbox will not become usable merely because SMTP AUTH is switched on.
Decide whether the mailbox or a shared address is the sender
The simplest arrangement is to authenticate and send from the same mailbox address. If WordPress must display a shared address, alias, or departmental address, grant the authenticated mailbox Send As permission for that address. Microsoft identifies missing Send As permission as a cause of error 5.7.60, so solve this before changing WordPress settings.
Register and authorize OAuth 2.0 in Microsoft Entra
The labels in the Entra portal can change, and the exact fields are supplied by the plugin. Follow the plugin’s current redirect-URI and permission instructions rather than copying values from an unrelated integration.
- Start the plugin connection flow. Open its Microsoft 365 or OAuth mailer settings and note the application type, redirect URI, client ID fields, and permission name it requests.
- Open Microsoft Entra app registrations. Create a new registration for this WordPress integration. Use a descriptive name tied to the site and its environment so administrators can identify it later.
- Enter the plugin’s redirect URI. Copy the URI exactly as displayed by the plugin. A mismatch, including a missing path or different protocol, causes the authorization callback to fail.
- Add the SMTP permission requested by the plugin. The integration should identify the Microsoft permission needed to submit mail, commonly the delegated SMTP permission. Do not add unrelated directory or mail permissions simply to make consent succeed.
- Grant consent when required. Some tenants require an administrator to approve the permission before a user can authorize the mailbox. Complete that approval under the organization’s normal change-control process.
- Return to WordPress and authorize the mailbox. Use the plugin’s Connect, Sign in, or Authorize button, choose the dedicated mailbox, and accept the requested consent. This binds the OAuth token to that mailbox; it does not automatically authorize every mailbox in the tenant.
- Store application data securely. If the plugin asks for a client secret, keep it in the plugin’s protected settings and restrict who can view it. Rotate or revoke it when the integration is retired or compromised.
OAuth authorization can fail even when the app registration is correct if the mailbox is not allowed to use SMTP AUTH. Treat policy, permission, and token errors as separate checks rather than repeatedly reauthorizing the same account.
Configure the WordPress mailer
- Install the plugin. In the WordPress dashboard, open Plugins, choose Add New, install the maintained SMTP plugin you selected, and activate it. On multisite, follow the plugin’s network-activation instructions if one central configuration is required.
- Open the mailer settings. The menu may appear under Settings, Tools, or a plugin-specific dashboard. Select Microsoft 365 OAuth when offered; otherwise choose a custom SMTP mailer.
- Connect OAuth. Complete the Entra authorization described above. If the plugin exposes a manual SMTP form as well, select OAuth 2.0 for authentication and leave password fields empty unless your administrator has approved a password-based exception.
- Enter the server values. Use the host, port, TLS/STARTTLS, and sender values from the settings table. Copy the host character for character and do not replace it with an IP address.
- Set the From address. Use the authenticated mailbox, or the alternate address for which Send As permission has already been granted. Set the From name separately if the plugin provides that field.
- Save and reload the connection. Some plugins do not apply a newly granted token until the settings page is saved or the connection is refreshed. Confirm that the plugin reports a connected account rather than relying on a green browser consent screen alone.
- Send a test message. Use the plugin’s test-email screen and send to an external mailbox you control. Record the exact diagnostic response, message ID, and timestamp before changing another setting.
Verify delivery and WordPress behavior
Check both acceptance and placement
A successful SMTP transaction means Microsoft accepted the message; it does not guarantee inbox placement. Confirm that the test arrives, inspect the spam or junk folder, and check the visible From address and Reply-To behavior. If the external mailbox never receives it, retain the plugin’s server response for the administrator instead of sending repeated tests.
Exercise real WordPress mail paths
After the plugin test works, trigger the forms that matter on the site: password reset, new-user notification, contact form, order or booking notification, and administrator alerts. Different plugins can bypass WordPress’s normal mail function, so a successful synthetic test is not proof that every extension uses the configured transport.
Review logs without exposing secrets
Enable logging only for diagnosis and restrict access to administrators. Logs should help identify SMTP response codes and recipient failures, but they should not expose OAuth refresh tokens, client secrets, or complete message bodies containing personal information. Set a short retention period when the investigation is complete.
Troubleshoot common Office 365 SMTP failures
| Symptom or code | Likely cause | Corrective action |
|---|---|---|
| 5.7.139 or a message saying SMTP AUTH is disabled | SMTP AUTH is blocked for the tenant or the mailbox. | Ask the Microsoft 365 administrator to check both scopes and enable it for the dedicated mailbox if organizational policy permits. Reconnect OAuth only after the policy is corrected. |
| 5.7.60, client cannot send as sender | The From address is not the authenticated mailbox and that mailbox lacks Send As permission. | Change WordPress’s From address to the authenticated mailbox or grant and verify Send As permission for the alternate address. Allow permission changes to propagate before retesting. |
| TLS handshake, timeout, or connection refused | The host is wrong, outbound submission traffic is blocked, or the server and Microsoft cannot agree on a modern TLS version. | Use the exact Microsoft 365 DNS host from the settings table, confirm the configured submission port is allowed by the web host and firewall, and require TLS 1.2 or 1.3 where selectable. Do not work around certificate errors by disabling verification. |
| Password authentication is rejected | The tenant or Microsoft is requiring Modern Authentication, or basic authentication is disabled by policy. | Replace the password-only connection with the plugin’s OAuth 2.0/XOAuth2 flow, register the Entra application, grant the requested SMTP permission, and authorize the mailbox. |
| OAuth consent returns to WordPress with an error | The redirect URI, client ID, tenant choice, or administrator consent does not match the plugin registration. | Compare the registered redirect URI character for character with the plugin value, confirm the correct tenant was selected, and have an administrator grant the exact permission requested. Remove stale registrations only after confirming that no other site uses them. |
| Internal mail works but external mail is missing | Recipient filtering, spam placement, transport rules, or a sender policy is affecting external delivery. | Check the external mailbox’s spam folder, review the SMTP acceptance response and Microsoft message trace with an administrator, and verify that the visible From address is authorized. |
| Only some WordPress messages use Microsoft 365 | An extension is bypassing the normal WordPress mail function or has its own mailer settings. | Trigger each important notification type, inspect the plugin log, and disable competing mailer integrations so one transport controls the site. |
Security and maintenance practices
- Use a dedicated mailbox. It limits the impact of a site compromise and avoids coupling website delivery to an employee’s account.
- Prefer delegated OAuth consent with least privilege. Grant only the SMTP permission the plugin documents, and remove the Entra app and mailbox access when the site is decommissioned.
- Protect the WordPress administrator account. Anyone who can alter the mailer settings may be able to redirect password-reset and notification mail.
- Keep TLS verification enabled. A working connection that ignores certificate errors is not a safe production configuration.
- Monitor failures and revoke stale access. Review logs and Microsoft sign-in or message-trace records when delivery changes, then rotate secrets or revoke tokens after staff or hosting changes.
- Recheck documentation after policy changes. Microsoft’s SMTP AUTH defaults, OAuth requirements, and plugin screens can change; confirm the current tenant policy before troubleshooting from an old screenshot.
Understand Microsoft 365 sending limits
Microsoft documents client-submission limits of 10,000 recipients per day and 30 messages per minute. These are Exchange Online limits, not a promise that a WordPress host can safely generate that volume, and they do not guarantee inbox placement. A site approaching either limit should use a dedicated transactional mail service or another Microsoft-supported sending method designed for higher-volume workloads, rather than trying to create multiple mailboxes to evade controls.
For ordinary password resets, form notices, and moderate administrative alerts, one properly configured mailbox is usually easier to secure and diagnose than a collection of ad hoc SMTP accounts.
Quick Recap
Production checklist
- Microsoft 365 mailbox is licensed, active, and reserved for the site.
- SMTP AUTH status is confirmed at both tenant and mailbox scope.
- Entra app registration uses the plugin’s exact redirect URI and requested SMTP permission.
- OAuth authorization is completed for the intended mailbox.
- WordPress uses
smtp.office365.com, port587, TLS/STARTTLS, and modern authentication. - From address is the authenticated mailbox or has verified Send As permission.
- External test delivery is confirmed, including spam-folder placement.
- Real WordPress notification paths have been exercised.
- Logs are restricted, temporary, and free of exposed tokens or unnecessary message content.
- Sending volume is well below Microsoft’s documented client-submission limits, or an appropriate high-volume service is planned.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
