How to Fix SMTP Error 535 When Connecting a Microsoft 365 Shared Mailbox to CRM
Question details
Users encounter SMTP authentication error 535 5.7.139 when attempting to connect a third-party CRM application to a Microsoft 365 shared mailbox.
- Product
- Microsoft 365 Exchange
- Device & OS
- not provided
- Scenario
- Configuring a third-party CRM platform to send emails via a Microsoft 365 shared mailbox using SMTP credentials.
- Observed behavior
- The connection fails and returns the error code '535 5.7.139 Authentication unsuccessful', even when correct app passwords are provided.
Ensure you have Microsoft 365 Global Administrator or Exchange Administrator privileges, as resolving this issue requires modifying tenant-level authentication settings and access policies.
Verify SMTP AUTH and App Password Configurations
Enable SMTP client authentication for the licensed user and properly configure an App Password if Multi-Factor Authentication (MFA) is active.
Because shared mailboxes do not have their own standalone passwords, you must authenticate the CRM using a fully licensed user account that has been granted 'Send As' or 'Full Access' permissions to the shared mailbox.
Log in to the Microsoft 365 Admin Center using your administrator credentials.
Navigate to 'Users' > 'Active users' and select the licensed user account attempting the connection. Go to the 'Mail' tab, click 'Manage email apps', ensure the 'Authenticated SMTP' box is checked, and click 'Save changes'.
If MFA is enabled for the licensed user, log in to their Microsoft account security settings. Under 'App passwords', generate a new app password specifically for the CRM.
In your CRM's email configuration, enter the shared mailbox address in the 'From' or 'Send As' field. For authentication, input the primary email address of the licensed user and the newly generated App Password.
Review Conditional Access Policies and Security Defaults
Azure Active Directory security features may actively block legacy authentication protocols like SMTP AUTH, overriding mailbox-level settings.
Boost Your Productivity with WPS Office
While resolving Microsoft 365 backend configurations, discover WPS Office as a robust solution for your local document workflows. It is a lightweight, highly compatible alternative to Microsoft Office that easily handles your daily tasks without high subscription costs.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button.
- 2. Install the Suite: Run the downloaded file and follow the quick setup wizard to install the software.
- 3. Work Seamlessly: Open your existing Microsoft Office files natively in WPS Office and start editing immediately.
Frequently Asked Questions
Why am I getting Error 535 5.7.139 even though my app password is correct?
This frequently happens because SMTP AUTH is disabled at the tenant level or blocked by Azure AD Conditional Access policies. These security measures override individual app passwords and prevent legacy authentication from succeeding.
Can a Microsoft 365 shared mailbox have its own unique password?
No, shared mailboxes in Microsoft 365 are essentially disabled user accounts and do not possess their own standalone passwords. You must authenticate using the credentials (or app password) of a licensed user who has been granted explicit permissions to the shared mailbox.
How can I securely connect my CRM without using legacy SMTP AUTH?
If your CRM system supports it, using modern authentication (OAuth 2.0) or integrating via the Microsoft Graph API is highly recommended. These methods are far more secure, natively support MFA, and bypass the need to enable vulnerable legacy protocols.
