Fix "535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled"

Exchange Online refused the login because SMTP AUTH is turned off for the tenant or for the specific mailbox. The text ends with "for the Tenant" or "for the Mailbox" to tell you which.

For the Mailbox

Connect-ExchangeOnline
Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false

For the Tenant

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Turning SMTP AUTH on for the whole tenant widens the attack surface for password spraying. Prefer enabling it only on the mailboxes devices use, and only until devices are moved.

Related: 535 5.7.3 and 535 5.7.8

"535 5.7.3 Authentication unsuccessful" usually means the password is wrong, MFA is required for the account, or security defaults block legacy authentication. Basic SMTP AUTH cannot complete an MFA prompt.

A fix that survives the basic auth retirement

Microsoft will remove basic auth for SMTP AUTH entirely (final date to be announced in the second half of 2027). Moving devices to SMTPKeep means they keep a simple SMTP login while the actual sending to Microsoft 365 uses OAuth through Microsoft Graph:

SMTP server	`smtp.smtpkeep.com`
Port	`587`
Security	STARTTLS (may be labelled TLS, "Use SSL/TLS: STARTTLS" or "Secure connection")
Authentication	SMTP AUTH on, username and password from the SMTPKeep dashboard
From / device email address	The mailbox you chose for the device, for example `scanner@yourdomain.com`
Older devices	If the device only supports TLS 1.0 or 1.1, use port `2525` instead