PrestaShop and Microsoft 365 email: fixing 535 5.7.139 and other SMTP errors

Customers say they never got their order confirmation. Or you press Send a test email in the back office and get a line of text that starts with 535. If the store sends mail through a Microsoft 365 mailbox (Exchange Online, Outlook for business), the cause is almost always one of a few settings, either in PrestaShop or in Microsoft 365.

This guide explains what each error means, which settings work in PrestaShop 1.7, 8 and 9, and what Microsoft is changing, so the fix you choose still works next year.

What the error tells you#

PrestaShop shows the reply of Microsoft's server as it is. The code in it says where to look.

• 535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant: sending with a username and password (SMTP AUTH) is turned off in your Microsoft 365 organization. Organizations created after January 2020 have it off by default. The password is fine, Microsoft just does not accept this way of signing in. See turning SMTP AUTH on below.
• 535 5.7.139 Authentication unsuccessful, basic authentication is disabled: the organization blocks sign-in with a password altogether, usually through Security defaults or an authentication policy. Turning SMTP AUTH on for the mailbox is not enough while these are in place.
• 535 5.7.3 Authentication unsuccessful: the username or password is wrong. The username must be the full email address. If the account uses multi-factor sign-in, a normal password usually will not work here.
• Connection could not be established with host "ssl://smtp.office365.com:587" with wrong version number at the end: this is PrestaShop 9 only, and it is the encryption setting. See the settings below.
• 5.7.60 Client doesn't have permissions to send as this sender: the store sends as an address other than the mailbox it signs in with. Either use the same address as the Shop email, or give the mailbox Send As permission for the other address in Microsoft 365.

If the test email works but customers still do not get mail, check the spam folder of a test customer and the SPF record of your domain. It should contain include:spf.protection.outlook.com. A domain may have only one SPF record: if an old one from previous hosting is still there next to it, both fail.

What is changing at Microsoft#

Microsoft has been retiring sign-in with a password (basic authentication) across Exchange Online for years. For receiving mail over IMAP and POP it has been gone since 2022. For sending (SMTP AUTH), the timeline updated in January 2026 is:

• until December 2026, nothing changes;
• at the end of December 2026, SMTP AUTH with a password is turned off by default in existing organizations. Administrators can still turn it back on;
• organizations created after December 2026 do not have it at all; OAuth is the only supported way;
• in the second half of 2027, Microsoft will announce the date when it is removed for good.

So a password still works for now, but only as long as someone keeps turning it back on, and not forever. Earlier dates (September 2025, March and April 2026) have been moved, which is why you may find older articles that say it is already over.

The settings that work#

In the back office, open Advanced Parameters > E-mail, choose Set my own SMTP parameters (for advanced users ONLY) and fill in:

• SMTP server: smtp.office365.com
• SMTP username: the full address of the mailbox, for example shop@yourdomain.com
• SMTP password: the password of that mailbox
• Port: 587. Microsoft does not support 465 for this.
• Encryption: depends on the version:
  • PrestaShop 1.7 and 8: TLS.
  • PrestaShop 9: None. The connection is still encrypted: PrestaShop 9 sends mail with Symfony Mailer, which switches to TLS on port 587 by itself (STARTTLS). With TLS or SSL selected, PrestaShop 9 tries an encrypted connection from the first byte, which Microsoft does not offer on port 587, and you get the wrong version number error above. We checked this in the code of PrestaShop 9.1.5 and against Microsoft's server.

Then check that Shop Parameters > Contact > Stores > Shop email is the same address as the SMTP username, save, and use Send a test email at the bottom of the E-mail page.

Microsoft limits one mailbox to 30 messages a minute and 10,000 recipients a day. That is plenty for order emails, but not for newsletters; send those through a newsletter service.

Turning SMTP AUTH on for one mailbox#

If the error is SmtpClientAuthentication is disabled, a Microsoft 365 administrator can turn SMTP AUTH on for the store's mailbox only, which is also what Microsoft recommends:

• In the Microsoft 365 admin center: Users > Active users, select the mailbox, Mail > Manage email apps, tick Authenticated SMTP and save.
• Or in Exchange Online PowerShell: Set-CASMailbox -Identity shop@yourdomain.com -SmtpClientAuthenticationDisabled $false

If Security defaults is on in Microsoft Entra ID, SMTP AUTH stays blocked until it is turned off, and turning it off weakens the protection of every account in the organization. Many small businesses keep it on for good reason. In that case, skip to the lasting options below.

This is a fix for now: from the end of December 2026 Microsoft turns the setting off by default, and later removes it.

Options that keep working#

PrestaShop itself only knows a username and a password for SMTP. There is no field for an OAuth token in versions 1.7, 8 or 9. So to send through Microsoft 365 without a password, something has to add OAuth. These are the realistic choices:

• An email sending service. Services such as Brevo, Mailjet, Amazon SES or SendGrid give you their own SMTP server and credentials, which PrestaShop accepts as they are. You add their records (SPF, DKIM) to your domain once. Replies from customers still reach your Microsoft 365 mailbox, because the From address stays yours. The difference is that sent mail no longer appears in the mailbox's Sent Items.
• A module that signs in with OAuth. A module can take over sending and use Microsoft Graph or SMTP with OAuth2, so the store keeps sending from the Microsoft 365 mailbox itself. It needs an app registration in Microsoft Entra ID, which is a one-time setup by an administrator.

Microsoft also lists options that do not fit a typical online store:

• SMTP relay with a connector needs a fixed IP address that is not shared with anyone, and Microsoft says it cannot be used from third-party hosting. Most PrestaShop stores run on exactly that.
• Direct Send and High Volume Email deliver only to addresses inside your own organization, so customers would never get their emails.

And customer replies?#

PrestaShop's Customer Service can read a mailbox and add customers' replies to the right conversation. With Microsoft 365, this has not worked with a password since Microsoft turned off password sign-in for IMAP in 2022, and PrestaShop's sync only knows a password. There is a second problem on newer servers: PHP 8.4, which PrestaShop 9 recommends, no longer includes the IMAP extension that this sync needs, so on many servers the sync is not available at all.

Until there is a fix, the practical way is to answer customers from Outlook, or to set the store's contact address to a mailbox that is not on Microsoft 365. We are working on a Microsoft 365 module for PrestaShop that sends with OAuth2 and brings replies back into Customer Service. If you want to hear when it is ready, write to us.

Need a hand?#

If you would rather not spend an afternoon in the Microsoft 365 admin center, we can set up email for your store: the right settings for your PrestaShop version, the mailbox in Microsoft 365, the SPF and DKIM records of your domain, and a test that order emails arrive. Tell us about your store, and we will reply with what it needs and what it costs.