Introduction
Microsoft is retiring Basic Authentication for SMTP Auth in Exchange Online, effective March 1, 2026. After this date, Microsoft will permanently disable Basic Authentication for client SMTP submission, requiring the use of modern authentication methods such as OAuth 2.0.
Spindle Self Serve uses SMTP Auth to send email notifications, as of version 1.7.8 the below method will be required to configure the OAuth SMTP connector to use Exchange Online endpoints.
Applies to
Spindle Self Serve v1.7.8 onwards
Resolution
1.Go to Entra Applications > App Registrations.
https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps
2.Make new registration and click Register.
3.Take a copy of your <client-id> and <tenant-id>.
4. Go to Manage > Certificates & secrets.
5. Create new client secret.
When creating your secret key, you can decide an expiry duration. By default this is 6 months for security. Upon expiry a new secret key will need to be created to continue emailing (no other steps will need to be completed).
6. Copy the value field. This is your <client-secret> and cannot be shown once leaving this page without creating a new secret.
Add the SMTP.SendAsApp permission
7. Go to API permissions and Add a permission.
8. Select the APIs my organization uses tab and search for "Office 365 Exchange Online".
9. Click Application permissions.
10. Scroll down and Tick SMTP.SendAsApp
11.Click Grant admin consent.
12. Open Windows Powershell and run:
- Install-Module -Name ExchangeOnlineManagement
- Import-module ExchangeOnlineManagement
- Connect-ExchangeOnline -Organization <tenant-id>
Keep this powershell open – we will run more commands in here soon.
13. Go to Entra Applications > Enterprise Applications and search for your application
14. Copy your <application-id> and <object-id>.
These may be different to application and object ids listed elsewhere, it is important you get them from here.
15.In the same powershell as earlier run:
- New-ServicePrincipal -AppId <application-id> -ObjectId <object-id>
- Get-ServicePrincipal | f
l
16. Copy the <sid> and run the command below:
- Add-MailboxPermission -Identity <email-address> -User <sid> -AccessRights FullAccess
17. In the same powershell as earlier run:
- Set-CASMailbox -Identity <email-address> -SmtpClientAuthenticationDisabled $false
- Get-CASMailbox -Identity <email-address> | Format-List SmtpClientAuthenticationDisabled
18. The details you will need to enter into S3 Settings > Advanced > Email Settings:
- <email-address> (Username)
- <client-id>
- <tenant-id>
- <client-secret>
Knowledge Base Article Details
| Related Product | Spindle Self Serve |
| Reference Number | KBA-09-01-002 |
| Document Date | 21/07/2025 |
| Original Author | Shannon Walker |
| Document Version | 1.0 |
| Last Updated | 21/07/2025 |
| Update Author | Shannon Walker |
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article