New personal Outlook.com account: SMTP AUTH disabled despite OAuth2; receiving and webmail work

The error message 535 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Mailbox occurs because Microsoft has progressively disabled direct SMTP client submission (SMTP AUTH) by default on newly created personal and consumer-tier Outlook.com/Exchange Online backend mailboxes.

Even though you are successfully authenticating via OAuth2 (which satisfies modern authentication for IMAP and webmail), Microsoft’s backend evaluates a separate protocol-level toggle called Authenticated SMTP specifically for sending via port 587. On newly provisioned personal accounts, this protocol is turned off at the server level.

Why This Happens on New Personal Accounts

While older Microsoft/Outlook accounts often retain legacy or default permissions allowing SMTP submission, new consumer and micro-tenant accounts are subjected to stricter baseline security protocols. Because SMTP submission bypasses typical web/app interactive prompts during the final handshake, the server explicitly rejects the relay request with a 535 error code even if your OAuth2 token is valid.

How to Resolve or Escalate This

Because this is a personal Outlook.com account, you do not have an Exchange Admin Center or an Office 365 tenant portal to toggle the switch yourself (the admin options referenced in online guides only apply to paid business or enterprise M365 subscriptions).

To bypass or resolve this block, use the following escalation path:

1. Use the Native Microsoft Account Support Escalation

Because consumer Outlook.com backend settings cannot be changed client-side, you must request that Microsoft Support manually provision or flip the SMTP AUTH flag on your mailbox backend:

• Go to the Microsoft Support page or sign in directly to your account and select Get Help.
• Type in a description of your issue, such as "Outlook.com personal account blocking SMTP client authentication (Error 535)."
• Skip the automated bot responses until you see an option to "Chat with an agent" or "Contact Support."
• Explicitly state to the support agent: "My new personal Outlook.com mailbox has SmtpClientAuthentication disabled at the server level. I am trying to configure an email client using OAuth2 on port 587, but the server returns a 535 SmtpClientAuthentication is disabled error. Please escalate this to backend engineering to enable SMTP AUTH for my specific mailbox."

2. Workaround: Use an App Password with Legacy Authentication (If available)

If your account allows generating app-specific passwords:

• Log into your Microsoft account dashboard via the web.
• Go to Security > Advanced Security Options > App Passwords.
• If an option to generate an app password exists, create one.
• In Thunderbird, change your authentication method on the Outgoing SMTP server settings from OAuth2 to Normal password, and paste the generated app password. (Note: If Microsoft has completely deprecated basic auth/app passwords for your newly minted consumer tenant, this option may be missing, forcing reliance on OAuth2).

3. Alternative Client Integration (Microsoft Graph / Exchange Web Services)

If Outlook.com support is unable or unwilling to flip the backend flag for a free consumer account, standard third-party desktop apps like Thunderbird will continue to be blocked from sending via SMTP. As an alternative, consider using the native web client interface or a mail client that natively interfaces via Microsoft’s modern synchronization protocols rather than standard IMAP/SMTP.

Suggestions for Next Steps

• Would you like to review alternative email clients or configurations that sync natively with Outlook.com via Microsoft’s web API extensions to bypass SMTP restrictions entirely?
• We can draft an exact, direct support ticket script designed specifically to get past frontline consumer support agents to backend Microsoft engineers.
• Would you like to explore deep research options regarding Microsoft's current deprecation timelines for legacy mail protocols on consumer outlook domains?

Hello,

Just to clear things up first, this is a public forum staffed by users and we are not Microsoft employees. We do not have backend access to change things for you and cannot escalate this directly to their service teams.

Microsoft progressively disables direct SMTP client submission by default on newly created personal Outlook mailboxes to prevent botnets. Before we can see how to fix this, I need to ask a couple of quick questions to understand the account status.

• Have you linked a real mobile phone number to the security dashboard of this Microsoft account yet?
• And when you send test emails from the web browser, does it occasionally pause to ask you for an SMS code or a puzzle captcha?

Let me know what you find out so we can check if it is a reputation issue.