'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Exchange Online SMTP Authentication Blocked by Security Defaults
Question details
SMTP authentication fails with error 535 5.7.139 because Microsoft Security Defaults block legacy authentication, even when SMTP AUTH is enabled for an individual mailbox.
- Product
- Exchange Online
- Device & OS
- not provided
- Scenario
- A user or application is attempting to send emails using basic SMTP authentication via an Exchange Online mailbox, but the connection is rejected.
- Observed behavior
- The connection fails with error 535 5.7.139. Basic legacy authentication is globally blocked by Microsoft Security Defaults, overriding the individual mailbox's SMTP AUTH settings.
Verify whether your application or device supports modern authentication (OAuth 2.0). If it does, upgrading your authentication method is the most secure and recommended approach.
Configure a Microsoft 365 SMTP Relay Connector
Set up a connector in the Exchange admin center to relay mail using your organization's environment without relying on blocked basic authentication.
Microsoft 365 SMTP relay allows multifunction devices or applications to send emails without requiring legacy basic authentication. This method maintains your organization-wide Security Defaults while allowing mail flow.
Log in to the Microsoft 365 admin center using your administrator credentials, then navigate to the Exchange admin center.
In the left-hand menu, go to 'Mail flow' and click on 'Connectors'.
Click 'Add a connector'. Choose 'Your organization's email server' as the sending source and select 'Office 365' as the destination.
Enter the static public IP address of the device or application that will send the emails, or use a trusted SSL certificate to authenticate the connection.
Review your settings, save the connector, and ensure it is toggled to the 'Enabled' state. Update your application to route emails to the MX record endpoint (e.g., yourdomain-com.mail.protection.outlook.com) on port 25.
Upgrade to Modern Authentication (OAuth 2.0)
Reconfigure your application to authenticate via OAuth 2.0 instead of legacy basic authentication.
A Seamless and Lightweight Office Suite Alternative
If you want to avoid complex administrative configurations and security blocks like Exchange SMTP errors, consider switching to WPS Office for your local document needs. It is a highly compatible, free, and lightweight alternative that allows you to easily view, edit, and create Office documents with a familiar interface and zero IT overhead.
- 1. Download WPS Office: Visit the official WPS website to download the free installation package for your operating system.
- 2. Install the Suite: Run the installer to quickly set up the lightweight office suite on your device.
- 3. Open Your Documents: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office files without formatting issues.
Frequently Asked Questions
Can I bypass Security Defaults to allow SMTP authentication?
While it is technically possible to disable Security Defaults at the organizational level to allow legacy authentication, Microsoft strongly advises against it as it leaves your tenant highly vulnerable to attacks. Using an SMTP relay or OAuth is the recommended approach.
Why does SMTP AUTH fail even when it is explicitly enabled for a specific mailbox?
Error 535 5.7.139 occurs because organization-wide policies, such as Security Defaults or Conditional Access, override individual mailbox settings. These policies proactively block the legacy basic authentication protocol used by traditional SMTP client submissions.
Does setting up a Microsoft 365 SMTP relay require an extra license?
No, configuring a Microsoft 365 SMTP relay connector does not require an additional license. However, the sending device or application must be authenticated via a static public IP address or a valid SSL certificate.
