535 5.7.139: Sign-in blocked by Conditional Access or MFA

Microsoft 365SMTPSign-in problem

The error usually looks like this:

535 5.7.139 Authentication unsuccessful, the request did not meet the criteria to be authenticated successfully. Contact your administrator.

What it means

The password was accepted, but a Microsoft Entra policy – usually Conditional Access or multi-factor authentication – prevented the sign-in.

Common causes

  • A Conditional Access policy blocks legacy authentication, or requires MFA, a compliant device or a trusted location.
  • Per-user MFA is enabled for the account.

How to fix it

  1. Check the user’s sign-in logs in the Microsoft Entra admin center to see which policy blocked the sign-in.
  2. Use OAuth 2.0 sign-in instead of a password. Auth-Email signs in with OAuth (completing MFA once in the browser) so that your app does not need to.

Tools to help diagnose it

Email server checker

Check any IMAP, POP or SMTP server’s encryption, certificate and supported sign-in methods

Tenant ID finder

Find your Microsoft 365 / Entra / Azure / Office 365 tenant ID from a domain name

Can’t update your app to use OAuth?

Auth-Email fixes sign-in errors like this one without changing your app, printer, scanner or script. It signs in to Microsoft 365 with OAuth on your app’s behalf, while your app keeps using a normal username and password over IMAP, POP or SMTP.

Read the docsTry Auth-Email →

← Look up another email error