outlook SMTP issue

Personal Outlook.com supports SMTP submission, but MailKit must authenticate with an OAuth2 access token—not the account password—and there is no Microsoft 365-style Authenticated SMTP mailbox toggle for you to enable.

Use these settings:

• Host: smtp-mail.outlook.com
• Port: 587
• Encryption: STARTTLS
• Authentication: OAuth2/SASL XOAUTH2
• Username: the complete Outlook.com address

These are Microsoft’s documented Outlook.com SMTP settings. Outlook.com requires Modern Authentication/OAuth2, and Basic Authentication has been unavailable for Outlook.com accounts since September 16, 2024.^1^^2^

Configure OAuth for MailKit

1. Register the application with Microsoft Entra.
2. Configure it to support personal Microsoft accounts.
3. Use a delegated interactive flow, such as:
   • Authorization-code flow for a web application, or
   • Device-code flow for a desktop/console application.
4. Request these delegated scopes:
   • https://outlook.office.com/SMTP.Send
   • offline_access
5. Have the Outlook.com user sign in and consent.
6. Pass the resulting access token to MailKit using SaslMechanismOAuth2.

OAuth2 for SMTP is explicitly supported for both Microsoft 365 and Outlook.com users. Microsoft documents https://outlook.office.com/SMTP.Send as the delegated SMTP permission; offline_access lets the application receive a refresh token so it can renew expired access tokens.^3^

Once the access token has been obtained through MSAL or the Microsoft identity platform, the MailKit send path is:

using var client = new MailKit.Net.Smtp.SmtpClient();

await client.ConnectAsync(
    "smtp-mail.outlook.com",
    587,
    MailKit.Security.SecureSocketOptions.StartTls);

var oauth2 = new MailKit.Security.SaslMechanismOAuth2(
    "[Email]",
    accessToken);

await client.AuthenticateAsync(oauth2);
await client.SendAsync(message);
await client.DisconnectAsync(true);

Do not replace accessToken with the Microsoft account password or an application client secret. For this personal-mailbox scenario, the token must represent the signed-in user and include the delegated SMTP scope.

If OAuth still returns the exact mailbox-disabled error

First inspect the access token and verify that:

• Its scope claim includes SMTP.Send.
• It was issued for the same personal Microsoft account supplied to SaslMechanismOAuth2.
• MailKit is actually selecting XOAUTH2 rather than authenticating with a username and password.

If those conditions are satisfied and the response remains:

535 5.7.139 Authentication unsuccessful,
SmtpClientAuthentication is disabled for the Mailbox

matching reports exist for personal Outlook.com mailboxes—particularly new accounts—where OAuth works for IMAP but SMTP OAuth is rejected at the mailbox level.^4^^5^

Those reports have no accepted or platform-endorsed resolution. Because a personal Outlook.com mailbox has no Exchange admin center or per-mailbox Authenticated SMTP control, Microsoft 365 tenant instructions for enabling that option do not apply. An app password also does not override mailbox-level SMTP disablement and is not a substitute for OAuth.

At that point, the practical paths are:

• Contact Outlook.com/Microsoft account support and provide the complete SMTP response, UTC timestamp, account type, and confirmation that XOAUTH2 with SMTP.Send was used.
• Use another transactional email service for application-generated mail.
• If the application requires unattended organization-controlled sending, use a service designed for application email rather than relying on a personal Outlook.com mailbox.

References

1. POP, IMAP, and SMTP settings for Outlook.com | Microsoft Support
2. Modern Authentication Methods now needed to continue syncing Outlook ...
3. Authenticate an IMAP, POP or SMTP connection using OAuth
4. Consumer Outlook.com OAuth2 IMAP Works but SMTP Fails with ...
5. Exchange Online / Outlook.com SMTP: OAuth2 XOAUTH2 send fails with 535 ...