535 5.7.139: SMTP AUTH is disabled for the tenant or mailbox

Microsoft 365SMTPSign-in problem

The error usually looks like this:

535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant. Visit https://aka.ms/smtp_auth_disabled for more information.

What it means

Authenticated SMTP (SMTP AUTH, also called client submission) is turned off for your whole Microsoft 365 organization, or for the mailbox you are signing in to.

Common causes

  • SMTP AUTH is disabled by default for new Microsoft 365 organizations.
  • An administrator has disabled SMTP AUTH for the organization or for this mailbox.

How to fix it

  1. An administrator can enable SMTP AUTH for just this mailbox in the Microsoft 365 admin center (Users → Active users → select the user → Mail → Manage email apps → Authenticated SMTP), or with PowerShell: Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false.
  2. Enabling SMTP AUTH only allows the protocol – your app must still sign in using OAuth 2.0 once basic authentication is retired. Auth-Email can do this for apps that cannot.

See also our guide: Enabling m365 smtp.

Tools to help diagnose it

Can’t update your app to use OAuth?

Auth-Email fixes sign-in errors like this one without changing your app, printer, scanner or script. It signs in to Microsoft 365 with OAuth on your app’s behalf, while your app keeps using a normal username and password over IMAP, POP or SMTP.

← Look up another email error