Office 365 SMTP Settings for FirstPAGE Server

When FirstPAGE Server is configured to send alarm email through a Microsoft 365 / Exchange Online mailbox, delivery may fail with an authentication error even though the credentials are correct. This usually happens because Microsoft disables SMTP client submission (SMTP AUTH) by default, or because tenant security settings block password-based (Basic) sign-in.

1. Symptom

FirstPAGE cannot send email through an Exchange Online mailbox. The FirstPAGE Server log reports an SMTP rejection similar to one of the following:

The server can typically connect to the mail server and negotiate STARTTLS successfully. The failure occurs specifically at the authentication step.

2. Typical Exchange Online SMTP Settings

For reference, the standard client submission settings FirstPAGE should use against Microsoft 365 / Exchange Online:

FirstPAGE provider configuration

1. In FirstPAGE Administrator, create a Device with Communications Type set to SSL.
2. Under that device, create a Provider with Protocol set to SMTP STARTTLS.
3. On the provider’s Connection tab, enter:
   • Host [:Port]: smtp.office365.com:587
   • User Name: the full email address of the sending mailbox
   • Password: the mailbox password (or app password, see Section 5)
   • From Address: the same sending mailbox address
   • Hello Domain: office365.com
   • Subject: up to 40 characters. Tags such as {SRV.HOST} can be inserted.
4. Save the provider. For each recipient, create a Destination on this provider with the recipient’s email address as the Network ID.

3. Root Cause

Microsoft disables SMTP AUTH (also called authenticated client SMTP submission) by default for new tenants, and it can also be disabled per mailbox. When it is disabled, Exchange Online rejects the login attempt with the 5.7.139 error regardless of whether the username and password are valid. The fix is to explicitly enable SMTP AUTH on the specific mailbox that FirstPAGE uses to send.

Separately, tenant-wide security settings (Security Defaults, Conditional Access, or MFA) can block password-based SMTP sign-in even after SMTP AUTH is enabled. That produces the 5.7.3 error and is covered in Section 5.

4. Fix: Enable SMTP AUTH on the Mailbox

This is done by a Microsoft 365 administrator, not from within FirstPAGE.

Method 1: Microsoft 365 admin center

1. Sign in to the Microsoft 365 admin center as an administrator with the appropriate role.
2. Go to the Active users list and select the mailbox FirstPAGE uses to send alarm email.
3. Open the Mail tab, then Manage email apps.
4. Check Authenticated SMTP and save.
5. Allow time for the change to propagate (it can take up to a few minutes), then retry sending from FirstPAGE.

Enabling SMTP AUTH per mailbox this way is preferable to changing the tenant-wide default, because it limits the change to only the account that needs it.

Method 2: Exchange Online PowerShell

Use this if Method 1 shows Authenticated SMTP as enabled but the 5.7.139 error continues. In some cases the mailbox setting appears enabled in the admin center, but PowerShell shows it as blank (null). A blank value means the mailbox follows the tenant-wide setting, which may be disabled.

1. Connect to Exchange Online. You will be prompted to sign in:
   Connect-ExchangeOnline
2. Check the tenant-wide setting. True means SMTP AUTH is disabled for the tenant; False means it is enabled:
   Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
3. Check the sending mailbox. False means enabled, True means disabled, and blank means it follows the tenant setting:
   Get-CASMailbox -Identity <sending mailbox address> | Format-List SmtpClientAuthenticationDisabled
4. Enable SMTP AUTH for that mailbox only:
   Set-CASMailbox -Identity <sending mailbox address> -SmtpClientAuthenticationDisabled $false
5. Wait a few minutes, then retry sending from FirstPAGE.

5. MFA / Security Defaults Considerations

If the tenant uses Security Defaults, or the sending mailbox has multi-factor authentication (MFA) enforced, standard SMTP AUTH with the normal account password will still be rejected, usually with 535 5.7.3. Basic SMTP submission cannot complete an interactive MFA prompt. The supported approaches are:

• Use the OAUTH-O365 provider (recommended): This avoids password-based SMTP entirely and keeps MFA in place. See Section 6.
• Use an App Password: If the tenant permits app passwords, generate one for the mailbox and enter it in the FirstPAGE provider’s Password field instead of the normal account password. The mailbox keeps MFA for interactive sign-in.
• Exclude the service account from the policy: An administrator may exclude the dedicated sending account from the MFA / Conditional Access policy. This requires Security admin access and should be coordinated with whoever owns the tenant’s security policy. Because it lowers the account’s protection, restrict the account to send-only use with a strong, rotated password.

Security Defaults: Security Defaults block legacy authentication for the whole tenant. They can be turned off in Microsoft Entra ID (Azure Active Directory) under Properties > Manage Security Defaults, but this affects every account in the tenant and must be the customer’s security team’s decision. Prefer the OAUTH-O365 provider or a targeted Conditional Access exclusion.

Note: Enabling Authenticated SMTP and adjusting MFA are separate settings and may be controlled by different administrators. If the person who can enable SMTP AUTH does not also have Security admin rights, the MFA change must be handled by the tenant’s security administrator.

6. Basic Authentication Retirement: Move to OAUTH-O365

Everything in Sections 4 and 5 relies on Basic authentication (a username and password sent over SMTP). Microsoft is retiring Basic authentication for SMTP AUTH:

• Through December 2026: Basic authentication for SMTP AUTH continues to work according to each tenant’s current settings.
• End of December 2026: Basic authentication for SMTP AUTH will be disabled by default for existing tenants. Administrators will still be able to re-enable it.
• Tenants created after December 2026: Basic authentication for SMTP AUTH will be unavailable by default.
• Second half of 2027: Microsoft will announce the final removal date.

Once Basic authentication is off, sends fail with 550 5.7.30 Basic authentication is not supported for Client Submission. For new installations, and for any customer hitting MFA or Security Defaults issues, configure the OAUTH-O365 provider instead of SMTP STARTTLS.

OAUTH-O365 provider setup

1. In Azure (customer’s administrator): In the Azure portal, open App Registrations, select the app registered for FirstPAGE Server, and open Certificates & secrets. Create a client secret or upload a certificate. Note the Tenant ID and the Application (client) ID. The application must be allowed to access the sending mailbox.
2. In FirstPAGE Administrator: Create a Device with Communications Type set to HTTP/REST.
3. Under that device, create a Provider with Protocol set to OAUTH-O365.
4. On the provider’s Options tab, enter:
   • Tenant ID and Application ID from the app registration
   • User ID for Email: the mailbox used to send (and receive responses)
   • Credential Type: Client Secret or Certificate, matching what was configured in Azure. Paste the secret, or browse to the certificate / .p12 private key and enter its Key Password if one is set.
   • Subject, Hello Domain and From Address as in Section 2
5. Save, then move the email destinations to the new provider (Network ID = recipient email address).

Tip: The customer’s Microsoft 365 administrator can run the SMTP AUTH Clients Submission report in the Exchange admin center. Its Authentication Protocol column shows whether the FirstPAGE mailbox is still sending with Basic authentication or OAuth.

7. Verify

1. If the connection itself is in doubt, test it from the FirstPAGE Server (SMTP STARTTLS provider only):
   Test-NetConnection smtp.office365.com -Port 587
TcpTestSucceeded : True confirms the port is reachable. Alternatively, telnet smtp.office365.com 587 should return a banner starting with 220.
2. After the settings propagate, select an email destination in FirstPAGE Administrator and click Test in the toolbar, or trigger a test alarm.
3. Check the FirstPAGE Server log (View > View Logs > Server Log). The 5.7.139, 5.7.3 or 5.7.30 error should no longer appear and the message should show as sent.
4. Confirm the message is received at the destination address.

8. Notes

• When a mailbox password is changed or rotated, the new password (or a newly generated app password) must be updated in the FirstPAGE provider configuration, or authentication will begin failing again. For OAUTH-O365, track the client secret’s expiry date in Azure and update FirstPAGE before it expires.
• Never store or share mailbox passwords, app passwords or client secrets in plain text over email or chat. If a credential has been exposed in cleartext, rotate it and update FirstPAGE with the new value.
• To be alerted when the email provider fails, configure the provider’s Notification tab to page an administrator destination on a different provider (not the same Office 365 mailbox).
• Microsoft’s current guidance on enabling or disabling SMTP AUTH in Exchange Online is available at aka.ms/smtp_auth_disabled.