'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Troubleshoot Legacy SMTP AUTH on Port 587 with TLS
Question details
Users need to resolve sign-in failures that occur when configuring legacy applications to send email via SMTP AUTH over port 587 with TLS.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Connecting a legacy application or service to an email server using SMTP AUTH on port 587 for outbound communications.
- Observed behavior
- Sign-ins over port 587 with TLS fail and are flagged by the system as risky sign-ins due to authentication policy blocks.
Ensure you have global administrator or security administrator privileges in the Microsoft Entra ID portal to view sign-in logs and modify Conditional Access policies.
Review Microsoft Entra ID Risk Controls and Authentication Logs
Identify the root cause of the risky sign-in blocks by analyzing Entra ID logs and adjusting trusted IP configurations.
Legacy authentication protocols like SMTP AUTH do not support modern Multi-Factor Authentication (MFA), causing Microsoft Entra ID to flag them as risky sign-ins by default.
To resolve this, you must configure Conditional Access to trust the source IP, which requires an appropriate Microsoft Entra ID Premium license.
Log in to the Microsoft Entra ID admin center, navigate to 'Monitoring', and select 'Sign-in logs' to identify the specific blocked legacy SMTP sign-in attempts.
If you hold a Premium license, navigate to 'Security' > 'Conditional Access' > 'Named locations' to add the application's static IP address as a trusted location.
Create a new Conditional Access policy that excludes your newly created trusted IP location from the strict MFA requirements for that specific application account.
Because this involves complex Microsoft Defender configurations, post your specific error details in the Microsoft Defender for Cloud section on Microsoft Q&A, or open an official Microsoft Support request via your portal.
Verify Mailbox-Level SMTP AUTH Status
Ensure that the specific Exchange Online mailbox used by the application is explicitly allowed to use SMTP authentication.
Switch to WPS Office for a Hassle-Free Experience
Troubleshooting advanced Microsoft Exchange and Entra ID network configurations can be highly complex and time-consuming. If you are looking for a reliable, lightweight, and completely free alternative to Microsoft Office for your daily document workflows, try WPS Office. It provides a full suite of robust editing tools without the overhead of complex enterprise network setups.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Software: Run the downloaded installer and follow the quick on-screen instructions to set up the suite.
- 3. Open Existing Documents: Launch WPS Office and directly open your existing Microsoft Office files without needing any format conversion.
Frequently Asked Questions
Why are my SMTP AUTH sign-ins flagged as risky?
Microsoft Entra ID uses advanced security defaults that often flag legacy authentication protocols, such as SMTP AUTH over port 587, as risky. This happens because legacy protocols generally do not support modern Multi-Factor Authentication (MFA) prompts.
Do I need a special license to whitelist IP addresses for SMTP?
Yes, utilizing Trusted IP locations and creating targeted Conditional Access policies to bypass MFA requirements typically requires a Microsoft Entra ID Premium P1 or P2 license.
How do I get expert help for Microsoft Defender network security configurations?
You can escalate the issue by posting your specific configuration details in the Microsoft Defender for Cloud section on Microsoft Q&A, or by opening a direct technical support ticket from your Azure or Microsoft 365 admin portal.
