To send reliable WordPress mail through Office 365 (now Microsoft 365), connect WordPress to an SMTP/OAuth mailer plugin and authenticate a licensed Microsoft 365 mailbox. Use smtp.office365.com, port 587, and TLS/STARTTLS. Prefer OAuth 2.0 rather than a stored password, make the WordPress From address match the authenticated mailbox (or grant it Send As permission), then send a test message and review the mailer log.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The setup fails most often because SMTP AUTH is disabled, the From address is not authorized, outbound port 587 is blocked, or a password-only integration is being rejected by current Microsoft security policy. The procedure below covers preparation, OAuth registration, WordPress configuration, testing, limits, and the exact fixes for the common Microsoft 365 error codes.
As an Amazon Associate I earn from qualifying purchases.
What you need before configuring WordPress
Gather these items before opening the WordPress dashboard:
- Administrator access to the Microsoft 365 tenant, or an administrator who can approve the mail settings and application consent.
- A licensed Microsoft 365 mailbox dedicated to WordPress notifications where practical. A dedicated account separates site alerts from a person’s correspondence and makes rotation, auditing, and revocation easier.
- Administrator access to WordPress and permission to install and configure a maintained SMTP mailer plugin.
- A destination mailbox outside the sending domain for delivery testing. External testing reveals authentication, routing, and spam-placement problems that a same-domain test can hide.
- A decision about the address visitors should see in the From field. It should normally be the mailbox you will authenticate, unless that mailbox is explicitly granted Send As permission for an alternate address.
Office 365 and Microsoft 365 are names for the same cloud service in this context. The server name and authentication rules come from Exchange Online, not from the WordPress host’s normal PHP mail configuration.
#1 Best Overall
Choose an SMTP plugin that supports Microsoft 365 OAuth
WordPress does not provide a native Microsoft 365 OAuth mailer. Install a maintained SMTP plugin that can complete an OAuth 2.0/XOAUTH2 connection, send a test message, and expose useful diagnostics. Settings labels differ by plugin, so use the values and sequence below while following the selected plugin’s current Microsoft 365 instructions.
| Plugin documented in the available material | Documented Microsoft 365 capability | What to verify before adoption |
|---|---|---|
| NimblyMail | Documents Microsoft 365 support, Azure OAuth endpoints, and an OAuth connection flow. | Confirm the current OAuth consent screens, test-email function, log retention, multisite behavior, and how credentials are protected. |
| Prostylemedia SMTP | Documents configurable SMTP and encrypted local secret storage. | Confirm that its current release supports the OAuth flow your tenant requires, plus test mail, diagnostics, multisite support, and a consistent From address. |
| DixonSMTP | Documents OAuth-only operation and Microsoft 365 troubleshooting guidance. | Confirm maintenance status, the exact consent process, logging controls, and whether alternate mailers are available if your sending workload changes. |
Compare plugins on seven practical axes: OAuth 2.0 support and the consent flow; test-email and mail-log tools; encryption or other protection for secrets; multisite support; maintenance cadence; fallback mailers; and the ability to force a consistent From address. A plugin that merely exposes username-and-password SMTP fields is not sufficient when your tenant requires Modern Authentication.
Prepare Microsoft 365 and Exchange Online
Use a licensed mailbox
Client SMTP submission authenticates as a mailbox. Create or designate a licensed account for site notifications, record its exact primary address, and ensure the account is allowed to sign in for the OAuth authorization. Shared mailboxes and aliases can be useful for the visible sender, but the account completing authentication still needs the required permission to send as that address.
Check SMTP AUTH at both levels
SMTP AUTH can be controlled for the whole organization and for individual mailboxes. Microsoft states that organizations created after January 2020 have SMTP AUTH disabled unless it is enabled per mailbox. Ask the Microsoft 365 administrator to verify the tenant setting and the sending mailbox setting. Enabling it may conflict with an organization’s security policy, so treat this as an intentional exception for the chosen account, not a setting to turn on broadly.
If the tenant blocks SMTP AUTH, a correct WordPress password or OAuth token will still fail. Record the organization’s decision and the mailbox scope so a future administrator knows why the setting exists.
Rank #2
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Register an application in Microsoft Entra
Modern Authentication for SMTP uses an application registration in Microsoft Entra. The exact screen names can change, but the workflow is:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Open Microsoft Entra app registrations and create an application for the WordPress mailer.
- Copy the redirect or callback URI shown by the plugin into the application registration. It must match exactly; differences in protocol, host, path, or trailing slash can prevent the consent return.
- Use the API-permission instructions supplied by the plugin and grant the SMTP permission it requests. Do not substitute a different permission merely because its name looks similar.
- Have an administrator grant consent when the tenant requires administrator approval. If the plugin uses a mailbox authorization step, authorize the dedicated sending mailbox, not an unrelated administrator account.
- Copy the client identifier and any secret or certificate value requested by the plugin into its connection screen, then complete the OAuth/XOAUTH2 authorization. Treat every secret as sensitive and store it only in the plugin’s protected settings.
Microsoft recommends Modern Authentication in the form of OAuth. A successful browser consent does not by itself prove that SMTP AUTH is enabled or that the selected mailbox can send as the From address; those are separate checks.
Enter the Microsoft 365 SMTP values in WordPress
After installing the plugin, open its mailer settings. The menu name varies, but it is usually under a top-level SMTP, Mail, or the plugin’s own settings menu. Enter these values when the plugin asks for manual SMTP details:
| Setting | Value | Qualification |
|---|---|---|
| SMTP host | smtp.office365.com |
Use the DNS name exactly. Microsoft says not to use an IP address. |
| Port | 587 |
Microsoft’s recommended client-submission port. Port 25 is also supported for client submission in Microsoft’s guidance, but 587 is the normal WordPress choice. |
| Encryption | TLS/STARTTLS | Use the plugin label that means STARTTLS on the existing connection. Do not select implicit SSL merely because it is offered as a generic SMTP option. |
| Authentication | OAuth 2.0/XOAUTH2 | Use the OAuth connection whenever the plugin provides it. Password authentication may be rejected by tenant policy or Microsoft’s modern-authentication requirements. |
| Username | The licensed Microsoft 365 mailbox address | Use the same mailbox that completed OAuth authorization unless the plugin explicitly documents another supported identity. |
Microsoft notes that port 465 does not meet the client-submission requirements. If a hosting firewall blocks outbound 587, ask the host or network administrator to allow it; changing the server to an IP address or switching randomly among ports will not solve the underlying problem.
Configure the From address and reply handling
Set WordPress’s From address to the authenticated mailbox during the first test. This removes a common variable and confirms that authentication and transport work independently of delegation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Using the authenticated mailbox
Enter the exact mailbox address in the plugin’s From Email field and enable any option that forces all site mail to use that address. WordPress plugins, themes, and form tools can otherwise supply their own From value and trigger a rejection even though the main mailer is correct.
Using an alias or another address
If the site must display another address, grant the authenticated mailbox Send As permission for that address in Exchange Online. Microsoft identifies missing Send As permission as a cause of nondelivery error 5.7.60. An alias existing in the directory is not, by itself, proof that the OAuth-authenticated mailbox may send as it.
Keep the Reply-To address separate when appropriate. For example, a notification can be sent from the dedicated mailbox while replies go to a support address. Verify that your plugin or form component sets Reply-To rather than replacing From with an unauthorized address.
Send a controlled test message
- Save the mailer settings and complete the OAuth connection without leaving the authorization window partway through.
- Use the plugin’s test-email screen to send a message to an external mailbox you control. Use the authenticated mailbox as From for this first test.
- Confirm that the message arrives, that the From and Reply-To headers are what you intended, and that it is not placed in spam or quarantine.
- Open the plugin’s diagnostic log and retain the exact error text if delivery fails. A numeric SMTP response is much more useful than a generic WordPress “mail failed” notice.
- Submit a real WordPress event, such as a password-reset request or form notification, after the plugin test succeeds. This catches themes or extensions that override the From address.
Plugin listings expose testing and logging differently. Some offer a one-click test and persistent logs; others provide only a connection result. Enable the least amount of log retention that still supports troubleshooting, and remove message bodies or recipient data from logs if the plugin permits it.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteTroubleshoot Microsoft 365 SMTP failures
Error 5.7.139: SMTP AUTH is disabled
Verify SMTP AUTH for both the tenant and the specific sending mailbox. The mailbox-level setting can override an organization-wide allowance. If policy permits, enable SMTP AUTH only for the dedicated WordPress account, wait for the setting to propagate, and retry the OAuth connection. If policy forbids SMTP AUTH, use an approved Microsoft-supported sending method instead of repeatedly changing WordPress credentials.
Rank #4
- Standard size: 6 pink server note pads, Each Book Comes with 50 bound order slips - that's 300 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, feel free to contact us, we'll appreciate it to learn from your experience, and we'll make it better
Error 5.7.60: the client cannot send as the sender
Change the WordPress From address to the authenticated mailbox and test again. If the alternate address is required, grant that mailbox Send As permission, allow time for directory changes to propagate, and verify that the plugin is not rewriting From after the main mailer saves it. Do not confuse Send As with Send on Behalf; the latter can produce different visible headers and may not satisfy the required sender authorization.
TLS negotiation or connection timeout
- Confirm the host is exactly
smtp.office365.com, with no typo or internal DNS name. - Confirm outbound TCP port 587 is permitted by the web host, cloud firewall, container network, and any corporate egress firewall.
- Select TLS/STARTTLS, not an implicit-SSL mode intended for a different port.
- Ensure the server’s TLS stack supports TLS 1.2 or TLS 1.3 and that its system clock is accurate enough for certificate validation.
- Retry from the plugin’s test screen and compare the new diagnostic text with the previous attempt. A timeout indicates a network path problem; an immediate SMTP response usually indicates authentication or policy.
Password-only authentication is rejected
Do not keep rotating the mailbox password. Microsoft recommends Modern Authentication, and current Microsoft 365 integrations expose OAuth/XOAUTH2 flows. Finish the Entra app registration and mailbox consent, then remove any unnecessary password from the plugin. If the selected plugin cannot perform OAuth, replace it with a maintained plugin that can rather than weakening tenant security.
OAuth consent loops or returns an invalid redirect
Compare the callback URI in Entra with the URI displayed by the plugin character for character. Check whether WordPress is forcing HTTPS, whether the site is behind a reverse proxy, and whether the public hostname differs from the internal hostname. Reauthorize the intended mailbox after correcting the URI. A consent performed by an administrator can still authorize the wrong mailbox if the browser is signed in to several Microsoft accounts.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The test succeeds but WordPress notifications fail
Inspect the failed notification’s From and Reply-To headers. A contact form, ecommerce extension, or theme may replace the mailer’s fixed From value. Force a consistent From address in the SMTP plugin, then configure the component to use Reply-To for visitor-entered addresses. Check the log for the actual recipient and SMTP response rather than relying on the browser’s success message.
Messages arrive in spam or quarantine
First distinguish transport from reputation: a successful SMTP transaction means Microsoft accepted the message, not that the recipient placed it in the inbox. Check the external mailbox’s spam and quarantine folders, inspect headers, and make sure the visible From domain and authenticated mailbox are logically related. Keep notification subjects and content clear, and avoid using a visitor’s address as the From identity.
Best Value
Understand Microsoft 365 sending limits
Microsoft documents Exchange Online client-submission limits of 10,000 recipients per day and 30 messages per minute. These are service limits, not a promise that a WordPress host can safely generate that volume. A busy site can hit the per-minute limit during a burst even when its daily total is small.
SMTP through a Microsoft 365 mailbox is appropriate for transactional notifications such as password resets, order updates, and administrator alerts. It is a poor fit for bulk campaigns, large mailing lists, or workloads that regularly approach the documented limits. For higher volume, evaluate a dedicated transactional mail service or another Microsoft-supported method approved by your organization. Do not create multiple mailboxes merely to evade a service limit; that complicates compliance and can trigger abuse controls.
Secure and maintain the connection
Protect OAuth credentials
- Restrict WordPress administrator access because anyone who can change the mailer settings can redirect site mail.
- Store client secrets and refresh tokens only in the plugin’s protected settings. Prefer a plugin that documents encrypted local secret storage, and keep database backups protected because encrypted application values can still be sensitive.
- Never paste a client secret, refresh token, or mailbox password into a support forum or public log.
- Remove unused app registrations and revoke consent when a site is decommissioned.
Plan for token and certificate changes
Document the Entra application name, tenant, redirect URI, authorized mailbox, and administrator who approved consent. Set a calendar reminder before any client secret or certificate expires. If the plugin supports a secretless or certificate-based option, follow its current documentation rather than assuming a password field can substitute for it.
Review delivery after WordPress changes
Retest after changing the site domain, forcing HTTPS, moving hosts, enabling a reverse proxy, changing the mailbox, or updating the SMTP plugin. These changes can alter the callback URI, outbound firewall path, or From address even when the Microsoft 365 tenant is unchanged. Keep a dated record of the last successful external test and the exact mailbox used.
When port 25 or another mailer is appropriate
Microsoft’s client-submission guidance supports port 25 as well as recommending port 587, but port 25 is commonly restricted by hosting providers and network firewalls because it is associated with unauthenticated server-to-server mail. Use 587 with STARTTLS for a normal WordPress mailbox connection. Do not switch to port 25 simply because 587 is blocked; ask the host to permit authenticated submission or use an approved relay.
If your site needs queueing, analytics, bounce processing, or sustained high-volume delivery, a transactional relay may be a better architecture than a personal or notification mailbox. Keep the same principles: authenticated submission, a controlled From identity, encrypted transport, and logs that do not expose message content unnecessarily.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Quick verification checklist
- The plugin is maintained and explicitly supports Microsoft 365 OAuth/XOAUTH2.
- A licensed sending mailbox exists and is the account authorized during OAuth.
- SMTP AUTH is allowed at the tenant and mailbox level in accordance with policy.
- The Entra redirect URI matches the plugin’s value exactly.
- The SMTP host is
smtp.office365.com; no IP address is used. - Port
587and TLS/STARTTLS are selected. - The WordPress From address is the authenticated mailbox or has documented Send As permission.
- Outbound port 587 and TLS 1.2 or 1.3 work from the web server.
- An external test message arrives and is checked for spam or quarantine.
- A real WordPress notification is tested after the plugin test.
- OAuth secrets, logs, and administrator access are protected.
- Your expected volume remains well below 10,000 recipients per day and 30 messages per minute.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
