# Microsoft 365 and Outlook

Connect a Microsoft 365 or Outlook.com mailbox to opendesk by forwarding, with replies through opendesk or Microsoft's SMTP server, or with Microsoft sign-in when your instance offers it.

Microsoft no longer accepts a password over IMAP for Outlook.com and Microsoft 365 mailboxes. So a Microsoft mailbox connects in one of two ways:

- **Microsoft sign-in**, when your instance offers it. You approve access once, and opendesk reads the mailbox and sends replies through it. See [Microsoft sign-in](#microsoft-sign-in-when-your-instance-offers-it).
- **Forwarding**. Microsoft passes incoming mail on to a private opendesk address. Replies go out through opendesk, or through Microsoft's SMTP server when your admin allows SMTP AUTH.

When Microsoft sign-in isn't offered, the wizard says so and recommends forwarding.

![Add a mailbox for support@contoso.com: Microsoft 365 detected from the domain's MX records ringed as 1, the note that Microsoft turned off password sign-in over IMAP ringed as 2, and Forward mail to opendesk, recommended, ringed as 3](https://docs.opendesk.sh/guides/mailboxes/microsoft-detect.webp)

1. **Microsoft 365**, found from the domain's MX records. Outlook.com, Hotmail and Live addresses show as **Outlook.com**.
2. **Why forwarding**: Microsoft turned off password sign-in over IMAP.
3. **Forward mail to opendesk**, recommended. **Other IMAP and SMTP** stays available for other servers.

## Connect by forwarding

**1. Add the mailbox and pick forwarding**

In **Settings**, open **Mailboxes** and click **Add mailbox**. Type a name and the address, keep **Forward mail to opendesk** selected and click **Continue**.

**2. Choose how replies are sent**

- **Through opendesk**: replies come from opendesk's sending address with your mailbox's name, and the customer's answers come back to your address. Nothing to set up.
- **Through your SMTP server**: replies come from your address itself, through `smtp.office365.com` on port 587 with STARTTLS. This needs SMTP AUTH turned on for the mailbox (see [Turn on SMTP AUTH](#turn-on-smtp-auth)).

![The connect step for support@contoso.com: Replies are sent, Through opendesk, ringed as 1, and the Create mailbox button ringed as 2](https://docs.opendesk.sh/guides/mailboxes/microsoft-forwarding.webp)

To send through Microsoft, choose **Through your SMTP server**. The server, port and security are filled in; type the mailbox's password and click **Connect**. opendesk signs in to the SMTP server before it saves anything.

![Through your SMTP server selected, ringed as 1, the note that Microsoft's SMTP server needs SMTP AUTH ringed as 2, and the outgoing mail settings for smtp.office365.com on port 587 with STARTTLS ringed as 3](https://docs.opendesk.sh/guides/mailboxes/microsoft-smtp.webp)

**3. Copy the forwarding address**

After you click **Create mailbox** (or **Connect**), the last step shows the private address to forward to, with a copy button, and the steps for Microsoft 365. You can find both again on the mailbox's page.

![Add a mailbox, done: the private forwarding address ringed as 1, and the four Microsoft 365 forwarding steps ringed as 2](https://docs.opendesk.sh/guides/mailboxes/microsoft-forward-to.webp)

**4. Forward the mail in Microsoft**

As an admin, in the [Exchange admin center](https://admin.exchange.microsoft.com), open **Recipients**, **Mailboxes** and select the mailbox. Under **Mail flow settings**, choose **Manage email forwarding**, turn on forwarding, paste the address and keep **Deliver to both** on if the mailbox should keep a copy. Without admin rights, use an Outlook rule instead. [Forwarding](/guides/mailboxes/forwarding/#microsoft-365-and-outlook) has both, step by step.

**5. Allow forwarding to outside addresses**

Microsoft 365 blocks automatic forwarding to outside addresses by default. An admin allows it in the [Microsoft Defender portal](https://security.microsoft.com): **Email & collaboration**, **Policies & rules**, **Threat policies**, **Anti-spam policies**. Open the outbound policy (or create one for the support mailbox only) and set **Automatic forwarding rules** to **On - Forwarding is enabled**.

Then write to the address from another account. The email shows up in **Unassigned** as a new ticket.

## Turn on SMTP AUTH

Sending replies through Microsoft's SMTP server needs **SMTP AUTH** (authenticated SMTP) for the mailbox. Many organizations keep it off. An admin turns it on for one mailbox:

**1. Open the user in the Microsoft 365 admin center**

In the [Microsoft 365 admin center](https://admin.microsoft.com), open **Users**, **Active users**, and select the user for the support address.

**2. Allow Authenticated SMTP**

On the **Mail** tab, choose **Manage email apps**, tick **Authenticated SMTP** and click **Save changes**. It can take up to an hour to apply.

The same in Exchange Online PowerShell:

```powershell
Set-CASMailbox -Identity support@contoso.com -SmtpClientAuthenticationDisabled $false
```

> **Note**
>
> - The per-mailbox setting wins over the organization's default, under **Settings**, **Mail flow** in the Exchange admin center.
> - **Security defaults** in Microsoft Entra, and Conditional Access policies that block legacy sign-in, refuse a password over SMTP for the whole organization. Turning SMTP AUTH on for the mailbox doesn't change that.
> - The account signs in with its password alone: an account that asks for multi-factor sign-in can't send this way.
> - Microsoft is phasing out password sign-in for SMTP AUTH in Exchange Online. When your organization no longer accepts it, send replies through opendesk.

If your admin keeps SMTP AUTH off, choose **Through opendesk**.

## If Microsoft refuses the sign-in

Nothing is saved when Microsoft refuses. The wizard shows the cause and the fix, with Microsoft's own reply underneath.

| What you see | What to do |
| --- | --- |
| **SMTP sign-in is turned off in Microsoft 365** | Turn on SMTP AUTH for the mailbox, as above, or send replies through opendesk. |
| **Microsoft security defaults block passwords** | Security defaults refuse passwords over SMTP and IMAP. Connect with Microsoft sign-in, or forward and send through opendesk. |
| **A Microsoft sign-in policy blocked this** | A Conditional Access policy refused the password. Connect with Microsoft sign-in, forward the mail, or ask your admin to allow SMTP AUTH for this mailbox. |
| **Microsoft needs Microsoft sign-in** | Exchange Online doesn't accept a password over IMAP. Connect with Microsoft sign-in, or by forwarding. |
| **Microsoft did not accept the password** | Check the address and password, including the sign-in address if it differs from the mailbox address. An account with multi-factor sign-in can't use a password here. |

## Microsoft sign-in, when your instance offers it

When your instance offers Microsoft sign-in for mailboxes, **Sign in with Microsoft** is the recommended way for Microsoft 365 and Outlook.com. opendesk reads the mailbox over IMAP and sends replies through Microsoft, so they land in its Sent folder. No password is stored.

**1. Pick Sign in with Microsoft**

Add the mailbox, type the address, keep **Sign in with Microsoft** selected and click **Continue**.

![The ways to connect a Microsoft 365 address with Sign in with Microsoft recommended and selected, ringed as 1, and Continue ringed as 2](https://docs.opendesk.sh/guides/mailboxes/microsoft-signin.webp)

**2. Approve access in Microsoft**

Click **Continue with Microsoft**, pick the Microsoft account for the address and accept the permissions. Microsoft sends you back to opendesk with the mailbox connected.

Some organizations require an admin to approve new apps. If you see **Need admin approval**, ask a Microsoft 365 admin to grant consent for opendesk.

### What opendesk asks for

| Scope | Why |
| --- | --- |
| `openid`, `email` | Identify which Microsoft account was connected. |
| `offline_access` | Keep the connection working after you close the browser. |
| `https://outlook.office.com/IMAP.AccessAsUser.All` | Read incoming mail over IMAP (`outlook.office365.com`). |
| `https://graph.microsoft.com/Mail.Send` | Send replies through the mailbox. |
| `https://graph.microsoft.com/User.Read` | Read the account's basic profile. |

Tokens are encrypted at rest with AES-GCM.

### IMAP must be enabled

In Microsoft 365, IMAP can be turned off per mailbox. An admin turns it on in the [Microsoft 365 admin center](https://admin.microsoft.com) under **Users**, **Active users**: select the user, then **Mail**, **Manage email apps**, and tick **IMAP**.

### Self-hosting

On your own instance, Microsoft sign-in for mailboxes needs your own Microsoft app (`MICROSOFT_CLIENT_ID` and `MICROSOFT_CLIENT_SECRET`), and `MICROSOFT_MAILBOX_OAUTH` turns it on or off for new mailboxes. See [Google and Microsoft OAuth](/self-hosting/oauth-apps/) and [Mailbox sign-in](/self-hosting/configuration/#mailbox-sign-in).

## Disconnect

Remove the mailbox in opendesk, under **Mailboxes**. Then, at Microsoft:

- **Forwarding**: turn off the forwarding or the Outlook rule, so mail stops going to the old address.
- **SMTP**: change the mailbox's password, or turn SMTP AUTH off again.
- **Microsoft sign-in**: remove opendesk from [My apps](https://myapps.microsoft.com), or as an admin from **Enterprise applications** in Microsoft Entra.

## Related

- [Connect a mailbox](/guides/mailboxes/)
- [Forwarding](/guides/mailboxes/forwarding/)
- [Other providers](/guides/mailboxes/imap-smtp/)