nanoPost

The WordPress Email Authority

Post SMTP + Microsoft 365: migrating off password authentication

Last reviewed/updated:

Post SMTP is installed. Its mailer type is SMTP, the host field reads smtp.office365.com, and the credential fields hold a mailbox address plus an app password. Contact forms, password resets, and order receipts have all flowed through that connection since the day the site went up.

At the end of December 2026, Microsoft will disable SMTP AUTH Basic Authentication by default for all Exchange Online tenants. Admins can re-enable it after that date, but Microsoft has signalled full removal in 2H 2027. The connection breaks the moment the default flips unless you act beforehand. When it does, Post SMTP’s log fills with:

550 5.7.30 Basic authentication is not supported for Client Submission

Three paths lead out. The cost differences are large enough to name before the detail: the cheapest option costs nothing at the plugin level; the most expensive costs $99.99 a year. The table below shows where each fits. The pillar hub carries the timeline and the routing for readers on a different plugin.

Your three paths

Path What changes What it costs When it fits
A. Buy Post SMTP Pro Business tier Microsoft 365 stays as the sender. Post SMTP stays as the plugin. The mailer switches from SMTP with a password to Microsoft Office 365 OAuth via One-Click Setup. Post SMTP Pro Business at $99.99 a year. Post SMTP is already on the site for the failure-alert layer or another Business-tier capability, and the One-Click Setup is an incremental add-on on a tier you were going to buy anyway.
B. Switch to a cheaper mailer plugin Microsoft 365 stays as the sender. Post SMTP is replaced. Either FluentSMTP (free, own Entra app) or WP Mail SMTP Pro (~$49 first year, no Entra app) takes over. FluentSMTP: $0 at the plugin level. WPMS Pro Basic: ~$49 first year, $99 renewal. Post SMTP was installed for reasons that no longer apply, and the Microsoft 365 mailbox as the visible From address still matters.
C. Switch to a transactional provider Microsoft 365 leaves the sending path. Post SMTP stays as the plugin. A dedicated sending service takes over. Free tiers or trials cover most WordPress-transactional volumes. Microsoft 365 was in the stack for expedience rather than for sender identity, and you do not need the mailbox address as the visible From.

Doing nothing is not on the table. The site stops sending; contact forms, password resets, and order receipts fail silently until fixed.

Path A: Buy Post SMTP Business tier for Microsoft Office 365 OAuth

  1. Buy the Business tier. Post SMTP Pro Business is $99.99 a year at postmansmtp.com/pricing. The two cheaper Pro tiers, Basic at $59.99 and Professional at $79.99, do not include the Microsoft One-Click Setup. This is the single most misread part of Post SMTP’s licensing: the Business tier is not just a seat-count difference; it is the tier that includes the OAuth integration. Verify all three prices on the pricing page before paying; the Pro ladder has restructured before.
  2. Activate the licence. Post SMTP > Settings > Licence. Paste the key from the postmansmtp.com account dashboard. Business-tier features unlock inside the plugin; there is no separate extension to install.
  3. Reconfigure the mailer. Post SMTP > Settings > Account. Change the mailer type from “SMTP” to “Microsoft 365 / Outlook” and pick “One-Click Setup”. A Microsoft consent screen opens: sign in as the Microsoft 365 mailbox owner and approve.
  4. Grant tenant admin consent. The Post SMTP app needs consent at the tenant level. On reseller-provisioned Microsoft 365 tenants (GoDaddy, IONOS, hosting-bundled add-ons) the site owner often does not have Global Administrator. If the consent screen returns “admin approval required”, route the request URL to whoever owns the tenant. Without consent the connection returns AADSTS65001 and no mail moves.
  5. Test and monitor. Post SMTP > Send Test Email. A successful send returns without the 5.7.30 string. Watch Post SMTP > Email Log for 24 hours. A recurring 5.7.30 at this stage usually means a caching plugin is serving a stale settings page to an admin session that re-saves the old SMTP values on the next edit.

Path B: Switch to a cheaper mailer plugin

Two viable targets, and the choice between them comes down to whether the operator can reach Microsoft Entra.

Switch to FluentSMTP (free plugin, own Entra app)

Cost is $0 at the plugin level; the price is paid in operator time. FluentSMTP reaches Microsoft 365 OAuth by having the site owner register their own app in Microsoft Entra ID, grant it the Mail.Send Graph permission, and produce a client secret that has to be rotated before its expiry. Best fit for an operator with Global Administrator on the tenant and access to the Entra admin center.

Install FluentSMTP alongside Post SMTP and complete the FluentSMTP setup while the old plugin still handles mail. Once the new connection tests green, uninstall Post SMTP. The full Entra walkthrough is in the FluentSMTP + Microsoft 365 migration guide. Post SMTP’s Email Log does not migrate; keep Post SMTP installed for a reference window if the history matters, or accept the loss on uninstall.

Switch to WP Mail SMTP Pro (paid, no Entra app)

Cost is roughly $49 first year and $99 on renewal for the Pro Basic tier, about half the Post SMTP Business tier. WPMS’s One-Click Setup uses a centrally managed app, so no Entra app registration is required from you and there is no client-secret rotation. Best fit for an operator without a route to the Entra admin center (a reseller-provisioned Microsoft 365 tenant is the standard case) or who does not want to own the app-registration lifecycle.

Buy WPMS Pro Basic, install alongside Post SMTP, and follow the One-Click Setup in the WP Mail SMTP + Microsoft 365 migration guide. Uninstall Post SMTP once the new connection tests green. WPMS’s Debug Events log covers similar depth to Post SMTP’s Email Log; what it does not cover is the mobile-app failure-alert layer, and if that was the original reason for choosing Post SMTP the answer is Path A, not Path B.

Path C: Switch to a transactional provider

The sender identity shifts in Path C. The Microsoft 365 mailbox address leaves the From field; a subdomain of your domain (typically send.example.com) takes its place. For contact forms, password resets, and order receipts, this distinction is invisible to recipients. It only matters when recipients expect to reply to the Microsoft 365 mailbox and that inbox isn’t forwarding replies onward. If sender identity doesn’t matter, this path drops the tenant-admin coordination step entirely.

Post SMTP ships native mailers for Postmark, SMTP2GO, Mailgun, and SendGrid in the free plugin. Only the mailer selection and credentials change.

  1. Pick the provider. Postmark leads on deliverability for pure transactional mail (100 emails a month free, permanent). SMTP2GO is 1,000 emails a month free, good for mixed transactional and light marketing. Mailgun offers 100 emails a day free (permanent), and makes sense when other Mailgun infrastructure is already in the stack. SendGrid runs a 60-day trial at 100 emails a day; after that it is paid from $19.95 a month, with no permanent free tier. The SMTP providers roundup runs the full comparison.
  2. Provision the domain. Sign up, verify the domain, and publish the SPF and DKIM records the provider issues. Sending from the mailbox address itself is possible but breaks Microsoft 365’s inbound reply routing unless the mailbox forwards those replies onward.
  3. Reconfigure Post SMTP. Post SMTP > Settings > Account. Change the mailer type from “SMTP” to the provider (all four ship in the free plugin), paste the API key or SMTP credentials from the provider dashboard, and Send Test Email. Same 24-hour monitoring window as the other paths.
  4. Retire the Microsoft 365 SMTP AUTH configuration. In the mailbox owner’s account portal, under Security > App passwords, revoke the app password the site was using. If tenant policy allows, an Exchange admin can also disable SMTP AUTH on the mailbox with Set-CASMailbox -SmtpClientAuthenticationDisabled $true. Both are optional but tidy.

Which path when

Take Path A when Post SMTP’s mobile-app failure alerts or another Business-tier capability is the reason the site is on Post SMTP. At $99.99 a year the Microsoft One-Click is a reasonable incremental line item on a tier the site was going to buy anyway, not a defensible standalone purchase.

Take Path B when Post SMTP is on the site for reasons that no longer apply (came pre-installed with a theme, or a previous admin picked it in a hurry) and the Microsoft 365 mailbox as the visible From address still matters. FluentSMTP is the answer with Entra access; WPMS Pro Basic is the answer without. Neither costs what Post SMTP Business does.

Take Path C when Microsoft 365 was in the stack for expedience rather than for sender identity. Transactional providers deliver contact-form notifications and order receipts more reliably than a repurposed mailbox does, and the available free tiers cover most WordPress-transactional volumes. A meaningful share of Post SMTP plus Microsoft 365 readers will find Path C is the answer they had been avoiding.

When none of the paths fit

If Post SMTP is on the site for its mobile-app alerting, there is no route to Global Administrator, and the Business tier is out of budget: Path C plus Post SMTP’s provider-side webhook or mobile alerts covers the failure-notification job at lower cost. The trade is the Microsoft 365 mailbox as the visible sender address.

If the site is on Microsoft 365 SMTP relay via connector (port 25 with an IP allowlist), or on Direct Send, the SMTP AUTH retirement does not apply and this is the wrong migration. Microsoft 365 SMTP relay and Direct Send covers those configurations.

Related