PHPMailer with Microsoft 365: OAuth and SMTP AUTH troubleshooting

Updated: 28 September 2026

PHPMailer can submit mail to Microsoft 365 using SMTP AUTH with OAuth. A failed login does not, by itself, establish that Microsoft has retired Basic Authentication for your tenant. First identify the authentication method, the mailbox policy and the exact server response.

What changed in the retirement timeline?

Microsoft revised its announcement in January 2026. As checked on 28 September 2026, SMTP AUTH Basic Authentication behavior remains unchanged until December 2026. At the end of December it will be disabled by default for existing tenants, with an administrator override still available. New tenants created after December will have it unavailable by default. Microsoft plans to announce the final removal date in the second half of 2027.

The earlier March–April 2026 shutdown schedule is obsolete. This does not mean password authentication is enabled in every organization: tenant security settings can already prohibit it. See the Exchange team’s revised timeline.

Choose SMTP OAuth or Microsoft Graph

For an existing PHPMailer SMTP integration, OAuth replaces the authentication mechanism while retaining SMTP. Microsoft Graph sendMail is a separate HTTP API. It uses Graph permissions such as Mail.Send; granting that permission does not configure an SMTP connection. If you choose Graph, implement its HTTP request and authorization flow instead of expecting PHPMailer’s SMTP transport to call the API. Graph’s accepted response also does not certify delivery to the inbox. See Microsoft Graph sendMail.

Configure the appropriate OAuth flow

• Delegated access: register an application in Microsoft Entra and request the SMTP scope https://outlook.office.com/SMTP.Send. A refresh-token workflow also needs the appropriate offline access consent.
• Application access: use Exchange Online’s SMTP.SendAsApp application permission, administrator consent and the Exchange service-principal/mailbox authorization steps. For SMTP client credentials, the token request uses https://outlook.office365.com/.default.

These flows are not interchangeable. Check the tenant, token audience, permissions, expiry and mailbox identity. Follow the complete Microsoft SMTP OAuth instructions, including the Exchange configuration for application access.

PHPMailer transport settings

This excerpt configures the transport only. It assumes Composer autoloading and an $oauthProvider object implementing PHPMailer\PHPMailer\OAuthTokenProvider, already configured for your chosen flow. It is not a complete token-acquisition or message-sending script.

use PHPMailer\PHPMailer\PHPMailer;

$mail = new PHPMailer(true);
$mail->isSMTP();
$mail->Host = 'smtp.office365.com';
$mail->Port = 587;
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
$mail->SMTPAuth = true;
$mail->AuthType = 'XOAUTH2';
$mail->setOAuth($oauthProvider);

Add the authorized sender, recipient and message after configuring the provider. Never put live credentials or tokens in a public example. The official PHPMailer repository documents its OAuth support and dependencies; its SMTP example shows the message-building portion.

Diagnose before changing security settings

1. Connection or TLS failure: check DNS, outbound access to port 587, STARTTLS and certificate validation before investigating credentials. Do not disable certificate verification.
2. Authentication rejection: record the full SMTP response and check the configured OAuth flow. A generic 535 response is not a diagnosis.
3. SMTP AUTH policy: have the administrator inspect the organization and mailbox settings. Security Defaults disables SMTP AUTH. Do not weaken a tenant-wide policy merely to make an example run; select an approved sending method.
4. Sender rejection after login: check whether the authenticated identity may send as the requested sender. Authentication and sender authorization are separate checks.

Microsoft explains the policy controls in Enable or disable SMTP AUTH. For protocol diagnostics, see our SMTPDebug guide. Keep logs private and redact addresses, credentials and tokens before sharing them.

Does OAuth guarantee inbox delivery?

No. Authentication permits a submission attempt; it does not guarantee acceptance or inbox placement. Check the server response, message trace and recipient feedback. Domain authentication, reputation and message content remain relevant after a successful SMTP login.

Documentation review: 28 September 2026. This guide does not claim a live sending test against your Microsoft 365 tenant.