Move a system that sends email by signing in to a Microsoft 365 mailbox with a user name and password, such as a printer, an ERP or a booking system. The system keeps sending over SMTP, through Sendora. Its server and its credentials change, and its From address may.
Microsoft is turning off password sign-in for SMTP, which it calls SMTP AUTH Basic authentication. Its Exchange Team Blog set out the timeline on 27 January 2026:
Until the end of December 2026, nothing changes.
From the end of December 2026, password sign-in for SMTP is off by default in existing Microsoft 365 organisations. An administrator can still turn it back on.
In organisations created after December 2026, it is unavailable by default, and OAuth is the way to sign in.
In the second half of 2027, Microsoft will announce the date it is removed for good.
A system that can sign in with OAuth can keep sending through Microsoft 365. This guide is for one that takes only a user name and a password.
A Sendora account. A test server works from the moment the account exists. A live server sends once your account is approved and its first payment has arrived, which Account › Billing in the dashboard shows.
Access to the DNS of the domain your system sends from.
Add the domain your system sends from under Domains, and add the two DNS records it shows, as Domains explains. The records leave your MX and SPF records as they are, so Microsoft 365 keeps receiving the domain’s mail.
Create a test server under Servers › New server, with Testserver ticked, and create a key on its API keys tab. The key starts with sk_test_. A test server takes mail as a live server does and delivers none of it.
In the system’s mail settings, replace Microsoft 365’s values with Sendora’s:
Setting
Microsoft 365
Sendora
Server
smtp.office365.com
smtp.sendora.se
Port and encryption
587 with STARTTLS
587 with STARTTLS, or 465 with TLS from the start
User name
The mailbox’s address
The server key
Password
The mailbox’s password
The server key
From address
The mailbox, or one it may send as
Any address on a verified domain
Send a message from the system, such as its test mail. Find it on the server’s Messages tab under Servers.
Once your account is approved and its first payment has arrived, create a key on your live server’s API keys tab, such as the default server that signup made. Put it in the system in place of the test key.
Once the system sends through Sendora, its mailbox no longer needs password sign-in for SMTP, so your Microsoft 365 administrator can leave it off.
Replies go where they went before. They reach the From or Reply-To address, so a mailbox in Microsoft 365 still receives them.
Microsoft 365 kept a copy of each message in the mailbox’s Sent Items. Sendora keeps no copy you can read. Its log shows each message’s recipients, statuses and timeline, for the time Retention gives.
Microsoft 365 put a bounce in the mailbox as a report. Sendora records it on the message, sends it to your webhooks, and adds an address that bounced hard to the suppression list.
Sendora accepts or refuses each message before the session ends. 535 5.7.8 means the key is wrong or revoked. 550 5.7.1 means the From domain is not verified, or that a live server’s account is not yet approved or paid. SMTP replies lists every reply.
# Move from Microsoft 365
Move a system that sends through a Microsoft 365 mailbox with a password to Sendora's SMTP.
Move a system that sends email by signing in to a Microsoft 365 mailbox with a user name and password, such as a printer, an ERP or a booking system. The system keeps sending over SMTP, through Sendora. Its server and its credentials change, and its From address may.
## What Microsoft changes
Microsoft is turning off password sign-in for SMTP, which it calls SMTP AUTH Basic authentication. Its Exchange Team Blog set out the timeline on 27 January 2026:
- Until the end of December 2026, nothing changes.
- From the end of December 2026, password sign-in for SMTP is off by default in existing Microsoft 365 organisations. An administrator can still turn it back on.
- In organisations created after December 2026, it is unavailable by default, and OAuth is the way to sign in.
- In the second half of 2027, Microsoft will announce the date it is removed for good.
A system that can sign in with OAuth can keep sending through Microsoft 365. This guide is for one that takes only a user name and a password.
## Before you start
- A Sendora account. A test server works from the moment the account exists. A live server sends once your account is approved and its first payment has arrived, which [Account › Billing](https://app.sendora.se/account/billing) in the dashboard shows.
- Access to the DNS of the domain your system sends from.
- Access to the system's mail settings.
## Move the system
1. Add the domain your system sends from under [Domains](https://app.sendora.se/domains), and add the two DNS records it shows, as [Domains](https://sendora.se/docs/domains) explains. The records leave your MX and SPF records as they are, so Microsoft 365 keeps receiving the domain's mail.
2. Create a test server under [Servers › New server](https://app.sendora.se/servers/new), with **Testserver** ticked, and create a key on its **API keys** tab. The key starts with `sk_test_`. A [test server](https://sendora.se/docs/test-servers) takes mail as a live server does and delivers none of it.
3. In the system's mail settings, replace Microsoft 365's values with Sendora's:
| Setting | Microsoft 365 | Sendora |
| ------------------- | ---------------------------------- | ------------------------------------------------- |
| Server | `smtp.office365.com` | `smtp.sendora.se` |
| Port and encryption | 587 with STARTTLS | 587 with STARTTLS, or 465 with TLS from the start |
| User name | The mailbox's address | The server key |
| Password | The mailbox's password | The server key |
| From address | The mailbox, or one it may send as | Any address on a verified domain |
4. Send a message from the system, such as its test mail. Find it on the server's **Messages** tab under [Servers](https://app.sendora.se/servers).
5. Once your account is approved and its first payment has arrived, create a key on your live server's **API keys** tab, such as the default server that signup made. Put it in the system in place of the test key.
6. Once the system sends through Sendora, its mailbox no longer needs password sign-in for SMTP, so your Microsoft 365 administrator can leave it off.
## What changes for the system
- Replies go where they went before. They reach the From or `Reply-To` address, so a mailbox in Microsoft 365 still receives them.
- Microsoft 365 kept a copy of each message in the mailbox's Sent Items. Sendora keeps no copy you can read. Its log shows each message's recipients, statuses and timeline, for the time [Retention](https://sendora.se/docs/limits#retention) gives.
- Microsoft 365 put a bounce in the mailbox as a report. Sendora records it on the message, sends it to your webhooks, and adds an address that bounced hard to the [suppression list](https://sendora.se/docs/suppressions).
- Sendora's [limits](https://sendora.se/docs/limits) apply instead of Microsoft's.
## If a message is refused
Sendora accepts or refuses each message before the session ends. `535 5.7.8` means the key is wrong or revoked. `550 5.7.1` means the From domain is not verified, or that a live server's account is not yet approved or paid. [SMTP replies](https://sendora.se/docs/smtp#smtp-replies) lists every reply.
Use in Claude
Use in ChatGPT