Configure SMTP with Microsoft 365 (Outlook)

You can send Plane's emails through a Microsoft 365 mailbox by enabling SMTP AUTH on that mailbox and entering its address and password in Plane's /god-mode/. Microsoft has no separate SMTP credentials to generate. The credentials are the mailbox's own email address and its password, or an app password if the mailbox uses multi-factor authentication (MFA).

WARNING

Plane signs in to SMTP with a username and password only. It doesn't support OAuth, so Microsoft 365 must allow password-based SMTP sign-in. Microsoft is retiring this, so read How long this will keep working before you start.

Check your account type

Account type	Example address	Works with Plane?
Microsoft 365 work or school (Exchange Online)	name@yourcompany.com	Yes, follow the steps below.
Personal Outlook.com, Hotmail or Live	name@outlook.com	No. Microsoft requires OAuth for these accounts. Use another provider.

Before you start

• A Microsoft 365 administrator (Global or Exchange admin). Steps 2 and 3 need admin rights.
• A licensed mailbox to send from.
• Instance admin access to Plane's /god-mode/.
• Outbound access from the Plane server to smtp.office365.com on port 587.

Step 1: Choose the sending mailbox

Use a dedicated, licensed Microsoft 365 mailbox such as plane@yourcompany.com, not a staff member's mailbox. Every email Plane sends, including invites, sign-in codes and notifications, comes from this address.

• The mailbox must be a licensed user mailbox that can sign in with its own password.
• A dedicated mailbox means a staff password change or departure doesn't break Plane's email.
• Microsoft limits a mailbox sending this way to 10,000 recipients per day and 30 messages per minute.

Step 2: Enable Authenticated SMTP on the mailbox

SMTP AUTH is off by default for organizations created after January 2020. Turn it on for the one mailbox Plane uses.

In the Microsoft 365 admin center

1. Open admin.microsoft.com and go to Users > Active users.
2. Select the sending mailbox's user, then select Mail.
3. Under Email apps, select Manage email apps.
4. Tick Authenticated SMTP.
5. Select Save changes.

With Exchange Online PowerShell

Set-CASMailbox -Identity plane@yourcompany.com -SmtpClientAuthenticationDisabled $false

To confirm, run the command below. False means SMTP AUTH is enabled for the mailbox.

Get-CASMailbox -Identity plane@yourcompany.com | Format-List SmtpClientAuthenticationDisabled

TIP

The change isn't always instant. If the test in Step 4 fails straight away, wait up to an hour and retry.

Step 3: Check tenant-level policies and get the password

Tenant policies

Even with Step 2 done, four tenant-wide settings can still reject the sign-in.

Setting	Where to check	What is needed
Organization-wide SMTP AUTH	Exchange admin center > Settings > Mail flow > Turn off SMTP AUTH protocol for your organization	Nothing, if Step 2 was done. The per-mailbox setting overrides this switch.
Security defaults	Microsoft Entra admin center > Identity > Overview > Properties > Manage security defaults	Must be disabled. Password-based SMTP doesn't work while security defaults is on.
Authentication policy	Exchange Online PowerShell (commands below)	Any policy assigned to the mailbox must allow basic authentication for SMTP.
Conditional Access	Microsoft Entra admin center > Protection > Conditional Access	Any policy that blocks legacy authentication must exclude the sending account.

WARNING

Security defaults enforces MFA for the whole tenant. Turning it off is your organization's decision. Replace it with Conditional Access policies that keep MFA on for everyone else. If you can't turn it off, use one of the alternatives.

To check the authentication policy:

# Which policy, if any, is assigned to the mailbox
Get-User -Identity plane@yourcompany.com | Format-List AuthenticationPolicy

# Whether that policy allows basic authentication for SMTP
Get-AuthenticationPolicy -Identity "<PolicyName>" | Format-List AllowBasicAuthSmtp

If AllowBasicAuthSmtp is False, enable it on that policy or assign the sending mailbox a policy that allows it.

Password

The password Plane uses depends on the sending mailbox's MFA setup.

Mailbox setup	Password to use in Plane
No MFA on this account	The mailbox's normal sign-in password.
Per-user MFA is enabled	An app password.
MFA enforced through Conditional Access	The normal password, after you exclude this account from the MFA policy. App passwords are generally not available in this setup.

To create an app password (per-user MFA only):

1. Sign in as the sending mailbox at mysignins.microsoft.com/security-info.
2. Select Add sign-in method, choose App password, and name it, for example Plane SMTP.
3. Copy the generated password straight away. Microsoft shows it only once.

If App password isn't in the list, your admin hasn't allowed app passwords for the tenant, or the account isn't on per-user MFA.

WARNING

If the mailbox password expires or is changed, Plane's email stops until you enter the new password in /god-mode/. Treat this password as a secret.

Step 4: Enter the settings in Plane

Open https://<your-plane-domain>/god-mode/, select Email in the sidebar, and enter these values.

Plane field	Value
Host	smtp.office365.com
Port	587
Sender email address	The sending mailbox, for example plane@yourcompany.com
Email security	TLS
Username	The sending mailbox's full email address
Password	The password from Step 3

Then:

1. Select Save changes.
2. Select Send test email and enter an address you can check.
3. Confirm the test email arrives. Check the junk folder too.

Common mistakes:

• Port 465 with SSL doesn't work with Microsoft 365. Use port 587 with TLS.
• The sender address must be the sending mailbox itself. A different address only works if the sending mailbox has Send As permission on it.
• Use the hostname smtp.office365.com, not an IP address.

If the test reports success but users still get no email, run this inside Plane's API container:

python manage.py test_email someone@yourcompany.com

Troubleshoot

Most failures are a Microsoft-side block, and the error text says which one. Find the exact error in the test email result or in the API and worker container logs.

Error contains	Likely cause	Fix
535 5.7.139 ... SmtpClientAuthentication is disabled	SMTP AUTH is off for the mailbox or tenant.	Step 2
535 5.7.139 ... basic authentication is disabled	Security defaults or an authentication policy blocks it.	Step 3
535 5.7.3 Authentication unsuccessful	Wrong password, MFA is required, or Conditional Access blocked the sign-in.	Step 3. The Entra sign-in logs for the account show the exact reason.
530 5.7.57 Client not authenticated	TLS is off, or username and password are blank.	Step 4: set Email security to TLS and fill in both fields.
5.7.60 Client doesn't have permissions to send as this sender	Sender email address differs from the sending mailbox.	Step 4: make them match, or grant Send As.
550 5.7.30 Basic authentication is not supported for Client Submission	Microsoft has switched off password-based SMTP for your tenant.	See How long this will keep working.
Connection timeout or refused	The firewall or hosting provider blocks port 587.	Open outbound TCP 587 to smtp.office365.com.
Worked before, now fails	The mailbox password changed or expired, or the daily limit was reached.	Update the password in /god-mode/, or wait for the limit to reset.

Microsoft 365 admins can also run Microsoft's diagnostic for this setup at aka.ms/smtprelay.

How long this will keep working

Microsoft is retiring password-based SMTP for Microsoft 365, so this setup works today but isn't permanent.

When	What Microsoft changes
Until December 2026	Nothing. The steps above work as written.
End of December 2026	Password-based SMTP is disabled by default for existing tenants. Your admin may need to re-enable it. Tenants created after this date don't have it by default.
Second half of 2027	Microsoft announces the final removal date.

If Plane's email stops working around the end of December 2026, check this first.

Alternatives

Each option gives a username and password that Plane can use, entered in the same Email screen.

Option	Good for	Note
Azure Communication Services Email	Teams that want to stay with Microsoft	Microsoft's recommended replacement for sending to internal and external recipients.
Microsoft 365 High Volume Email	Instances where every Plane user is inside your Microsoft 365 tenant	Can't send to external addresses, so invites to outside guests fail.
Amazon SES	Any team	Setup is covered in Configure SMTP for email notifications.
Another SMTP provider (SendGrid, Mailgun, Postmark and similar)	Any team, including personal Outlook.com accounts	The provider issues SMTP credentials directly.

References

• Configure SMTP for email notifications
• Microsoft Learn: Enable or disable SMTP AUTH in Exchange Online
• Microsoft Learn: Set up an application to send email using Microsoft 365