Knowledge: SMTP to Office365 using App Registration
Back
Knowledge
Title*SMTP to Office365 using App Registration
ManualAdministration
Manual Level TwoEmails
Created26/09/2025
DetailMicrosoft are retiring traditional SMTP access from March 1st, no exceptions!
Alternative could be to use a non Office365 SMTP relay. These instructions are for Office365 only.
To use Office365 to send email you need to add the following:
- You will need an Application Registration if one is not already setup for Sysero in Azure Driectory.
- We would recommend configuring this so mails can only be sent from a single shared mailbox (shared to avoid unecessary user license).
- This is done by creating a mail enabled security group in the Exchange Admin interface. And adding only a single member of the mailbox you want to send from.
- Open Azure Powershell
Connect-ExchangeOnline
New-ApplicationAccessPolicy
-AppId <Sysero-App-Id>
-PolicyScopeGroupId "thesecuritygroup@domain.com"
-AccessRight RestrictAccess
-Description "Restrict app access to this group".
- Note above is security group email not the one you will be sending from.
- You can test this before setting up next steps using Test-ApplicationAccessPolicy -Identity user@domain.com -AppId <Sysero-App-Id>. Try with shared mailbox you configured it should have access to and any other e-mail it should not.
- Application Registration needs Application Level Graph permission of Mail.Send.
- web.config in Sysero must have "smtpmode" app setting set to "graph".
- All other settings to app level registration are set as usual for other OAuth app level calls.
- Email from and Email templates must have FROM address set to one that is specified in the security group (not the security group email but the shared mailbox).
- Note you can setup other shared mailboxes and add them to the same group, if you want multiple from addresses.
Additional Manual Locations