SMTP Client Authentication

Enable SMTP Client Authentication.

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to the tenant as a whole.

1. Add it directly to a user or an Azure group (Adding a baseline), or bundle it into a user-level scheme and deploy that to many users or groups at once (Deploying a scheme). See Groups and priority for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.

2. Authenticated SMTP is the only setting on this baseline. It’s the protocol POP3 and IMAP clients use to send mail, and some line-of-business apps and multifunction devices use it too. Set it to the value your organisation requires. Microsoft’s guidance is to leave it off tenant-wide and switch it on only for mailboxes that need it, since this per-user setting wins over the tenant-wide switch.

3. Save. Turn on Auto-remediation and Octiga puts this back to whichever value the baseline requires if it’s changed for a user it applies to.

Caution

Turning Authenticated SMTP off for a user immediately stops anything that sends mail on their behalf that way — a POP or IMAP client’s outgoing mail, or an app using their mailbox to send. Confirm nothing still depends on it first.

Check it worked

Passing means the mailbox’s Authenticated SMTP setting matches what this baseline requires. Check it in the Microsoft 365 admin centre under Users → Active users → the user → Mail → Manage email apps, as the “Authenticated SMTP” checkbox (checked means enabled, unchecked means disabled). On the user roster or a group’s member list, Passing shows as a green dot; Deviated (red) means the mailbox doesn’t match; Excluded (grey) means the user or tenant isn’t licensed for Exchange Online. A user notices a change only if something sends mail through their account by SMTP rather than through Outlook: that traffic starts failing, or starts working again.

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→