# SMTP Client Authentication

> Enable SMTP Client Authentication.

Enable SMTP Client Authentication.

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to
the tenant as a whole.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or
   bundle it into a user-level scheme and deploy that to many users or groups at once
   ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how
   Octiga resolves which value a user gets when a Direct value, a scheme and a group all
   supply one.
2. **Authenticated SMTP** is the only setting on this baseline. It's the protocol POP3 and
   IMAP clients use to *send* mail, and some line-of-business apps and multifunction
   devices use it too. Set it to the value your organisation requires. Microsoft's
   guidance is to leave it off tenant-wide and switch it on only for mailboxes that need
   it, since this per-user setting wins over the tenant-wide switch.
3. Save. Turn on **Auto-remediation** and Octiga puts this back to whichever value the
   baseline requires if it's changed for a user it applies to.

> **Caution:** Turning Authenticated SMTP off for a user immediately stops anything that sends mail on
> their behalf that way — a POP or IMAP client's outgoing mail, or an app using their
> mailbox to send. Confirm nothing still depends on it first.

## Check it worked

Passing means the mailbox's Authenticated SMTP setting matches what this baseline
requires. Check it in the Microsoft 365 admin centre under **Users → Active users** →
the user → **Mail** → **Manage email apps**, as the "Authenticated SMTP" checkbox
(checked means enabled, unchecked means disabled). On the user roster or a group's member
list, Passing shows as a green dot; Deviated (red) means the mailbox doesn't match;
Excluded (grey) means the user or tenant isn't licensed for Exchange Online. A user
notices a change only if something sends mail through their account by SMTP rather than
through Outlook: that traffic starts failing, or starts working again.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)