535 5.7.139: Blocked by security defaults

Microsoft 365SMTPSign-in problem

The error usually looks like this:

535 5.7.139 Authentication unsuccessful, user is locked by your organization's security defaults policy. Contact your administrator.

What it means

Your Microsoft 365 organization uses security defaults, which block all sign-ins that use basic authentication (a username and password without OAuth).

Common causes

  • Security defaults are enabled in Microsoft Entra ID – they are switched on automatically for most new organizations.

How to fix it

  1. Switch your app to OAuth 2.0 sign-in, or use Auth-Email to sign in with OAuth on your app’s behalf.
  2. Turning off security defaults is not recommended: it weakens protection for your whole organization, and Microsoft is retiring basic authentication for SMTP AUTH regardless.

Tools to help diagnose it

Email server checker

Check any IMAP, POP or SMTP server’s encryption, certificate and supported sign-in methods

Admin consent URL generator

Generate the URL to authorize an OAuth app – including Auth-Email – with your Microsoft 365 organization

Can’t update your app to use OAuth?

Auth-Email fixes sign-in errors like this one without changing your app, printer, scanner or script. It signs in to Microsoft 365 with OAuth on your app’s behalf, while your app keeps using a normal username and password over IMAP, POP or SMTP.

Read the docsTry Auth-Email →

← Look up another email error