Fluent SMTP for Microsoft email

Configure FluentSMTP with delegated Microsoft Graph Mail.Send, authorize it as the same Microsoft 365 mailbox entered in From Email, and then delete and recreate the FluentSMTP connection so it obtains a new token with the corrected permissions.

Correct the authorization chain

1. In Microsoft Entra admin center → Identity → Applications → App registrations, open the application used by FluentSMTP.
2. Select API permissions.
3. Under Microsoft Graph, verify that Delegated permissions → Mail.Send is present and consent has been granted.
   • Do not substitute SMTP.Send; that permission is for SMTP AUTH, while FluentSMTP’s Azure / Microsoft Graph connection uses Graph.
   • Mail.Send delegated permission allows the application to send as the signed-in user. ^1^
4. In FluentSMTP, verify that From Email is the same Microsoft 365 mailbox that will be used during authorization.
5. Delete the existing Microsoft/Outlook connection in WordPress → Settings → FluentSMTP.
6. Clear the WordPress/site cache, create the connection again using FluentSMTP’s displayed callback URL, and sign in as that exact sender mailbox. Recreating the connection is important because an existing token will not necessarily contain newly added permissions. A matching 422 Unauthorized FluentSMTP case was resolved only after aligning the authenticated account with From Email and completely rebuilding the connection. ^2^
7. Run the email test again. A successful Graph sendMail request returns 202 Accepted. ^3^

Also verify that the callback/redirect URI in Entra app registration → Authentication exactly matches the URI displayed by FluentSMTP, including scheme, hostname, path, and trailing slash. Follow the plugin publisher’s Microsoft 365 setup sequence when recreating the connection. ^4^

If From Email is another or shared mailbox

If FluentSMTP is authorized as one user but From Email belongs to another user or shared mailbox, delegated Mail.Send alone is insufficient:

1. Add Microsoft Graph delegated permission Mail.Send.Shared.
2. Grant the signed-in user either Send As or Send on Behalf permission for the sender mailbox in Microsoft 365.
3. Delete and recreate the FluentSMTP connection again.

Graph requires both Mail.Send.Shared and the applicable Exchange mailbox delegation for this scenario. Without mailbox delegation, Graph can return ErrorSendAsDenied. ^5^

If FluentSMTP uses the /users/{sender} form rather than /me, Full Access may also be required in addition to Send As or Send on Behalf. ^5^

If this is a staging or unverified domain

A reported case with the same FluentSMTP 422 Unauthorized response involved a staging-site domain that was not verified in the Microsoft 365 tenant. If that applies:

1. Check whether the website’s domain is verified in the Microsoft 365 tenant.
2. Verify it there, or repeat the setup on the live site that uses the tenant’s verified domain.
3. Delete the FluentSMTP connection, clear site caches, and create and authorize the connection again. ^2^

If it remains unauthorized

Check FluentSMTP → Email Logs and open the failed test. If the plugin exposes the underlying Graph response:

• ErrorSendAsDenied indicates sender/mailbox delegation is missing.
• A token or consent error points back to the app registration, delegated permission, or authorization account.
• Entra sign-in logs can identify token issuance, consent, or Conditional Access failures, but an Exchange send-authorization rejection must be diagnosed from FluentSMTP’s underlying Graph response when available.

The outer 422 is FluentSMTP’s wrapper and does not, by itself, identify which part of the authorization chain failed.

References

1. Microsoft Graph permissions reference
2. Intermittent Error 422 Unauthorized using Office365 #195
3. user: sendMail
4. Outlook or Office365 with FluentSMTP
5. Send Outlook messages from another user using the Outlook mail API ...