If you're trying to connect Outlook or Microsoft 365 to a sending tool, a mail client, or a script, you need the right server, port, and encryption — and you need app passwords set up correctly, or authentication will fail. This guide gives you the exact Office 365 SMTP settings as of 2026, plus IMAP and POP, how app passwords work, sending limits, and how to fix the errors that trip most people up.
Microsoft settings shift over time, especially around authentication, so treat the values below as current-as-of-2026 and confirm against Microsoft's own documentation if something doesn't connect.
Office 365 SMTP settings (for sending mail)
For a Microsoft 365 business mailbox, the outgoing (SMTP) settings are:
- SMTP server: smtp.office365.com
- Port: 587
- Encryption: STARTTLS
- Username: your full email address
- Password: your app password (see below), or account password if SMTP AUTH allows it
- Authentication: required
Port 587 with STARTTLS is the modern standard for authenticated mail submission. Older guides mention port 25, but 25 is for server-to-server relay and is usually blocked for client sending. Avoid it.
If you're on a personal Outlook.com, Hotmail, or Live account rather than a business tenant, the server is different:
- SMTP server: smtp-mail.outlook.com
- Port: 587, STARTTLS
Office 365 IMAP and POP settings (for receiving mail)
To read mail from Microsoft 365 in a client or tool, use IMAP (recommended — it keeps mail in sync across devices):
- IMAP server: outlook.office365.com
- Port: 993
- Encryption: SSL/TLS
If you specifically need POP3 instead (which downloads and often removes mail from the server), use:
- POP server: outlook.office365.com
- Port: 995
- Encryption: SSL/TLS
For personal Outlook.com accounts, the incoming servers are imap-mail.outlook.com (993, SSL/TLS) and pop-mail.outlook.com (995, SSL/TLS). If you're deciding between the two protocols, this explainer on what IMAP is covers why IMAP is almost always the better choice for connected tools.
Why you probably need an app password
Here's where most people get stuck. If your account has multi-factor authentication (MFA) enabled — and in 2026 the vast majority of Microsoft 365 tenants do — you generally can't sign in to SMTP or IMAP with your normal password. Microsoft blocks that as a security risk, because a third-party app can't complete the second factor.
The workaround is an app password: a unique, randomly generated password tied to one application. It bypasses the MFA prompt for that single connection while keeping your main login protected.
To create one on a personal Microsoft account, go to your account security settings, open the additional security or "app passwords" area (visible only when two-step verification is on), and generate a new password. Copy it immediately — you usually can't view it again. Paste it into the tool's password field in place of your normal password.
On Microsoft 365 business accounts, app passwords may need to be enabled by an administrator. If security defaults are turned on, app passwords are typically blocked, and an admin has to switch to conditional access policies to allow them. This is the number-one reason business users can't connect.
How to connect Outlook to a sending tool via SMTP
Most outreach and sales tools connect a mailbox one of two ways: OAuth (a "Sign in with Microsoft/Google" popup) or manual SMTP/IMAP credentials. Microsoft OAuth support varies by tool, so many platforms connect Outlook through SMTP with an app password instead — which is exactly how ClickReach does it. You add your Outlook or Microsoft 365 mailbox by entering the SMTP host, port, and your app password, and the IMAP details so the tool can detect replies.
The setup, step by step:
- Confirm SMTP AUTH is enabled on the mailbox (admins: Microsoft 365 admin center, Active users, select the user, Mail, Manage email apps, tick Authenticated SMTP).
- Enable MFA on the account if it isn't already.
- Generate an app password.
- In the tool, enter smtp.office365.com, port 587, STARTTLS, your full email as username, and the app password.
- Add IMAP: outlook.office365.com, port 993, SSL/TLS, same credentials.
- Send a test message and confirm it arrives.
If you're running cold outreach across several mailboxes, spreading volume matters. Distributing sends with sender rotation across multiple connected inboxes keeps any single Outlook mailbox from hitting limits or looking like a spam cannon.
OAuth or SMTP: which should you use
If a tool offers Microsoft OAuth sign-in, it's often the smoother path — no app password to generate, and the connection survives a password change. But OAuth support for Microsoft accounts is inconsistent across third-party tools, and business tenants sometimes restrict which apps are allowed to use it at all. That's why SMTP with an app password remains the most universally reliable way to connect an Outlook or Microsoft 365 mailbox to an outreach platform: it works anywhere SMTP AUTH is enabled, regardless of which OAuth apps your tenant permits. If OAuth is offered and your admin allows it, use it. If not, the app-password route above is the dependable fallback that gets you connected.
Sending limits you need to respect
Microsoft enforces rate limits to prevent abuse, and blowing past them gets your mailbox throttled or temporarily blocked. As of 2026, Microsoft 365 business mailboxes are commonly capped around:
- 10,000 recipients per day
- 30 messages per minute
- A limited number of recipients per single message (often 500)
Personal Outlook.com accounts are far lower — often around 300 recipients per day. These figures change, so verify against current Microsoft limits before you scale. The practical takeaway: a single Outlook inbox is not built for high-volume cold email. If you need real volume, warm up gradually, keep daily sends conservative, and split across multiple mailboxes.
Fixing common authentication errors
The error you'll see most is some variation of "535 5.7.139 Authentication unsuccessful." Work through these causes in order:
- You're using your normal password instead of an app password. Generate and use an app password.
- SMTP AUTH is disabled on the mailbox. Have an admin enable Authenticated SMTP for that user.
- Security defaults are blocking basic auth. An admin needs to adjust conditional access to permit SMTP AUTH.
- Wrong server or port. Confirm smtp.office365.com and port 587 with STARTTLS, not SSL on 465.
- The account is a personal Outlook.com address but you're using the business server (or vice versa). Match the server to the account type.
If mail sends but lands in spam rather than the inbox, authentication settings aren't the problem — your domain reputation is. Make sure SPF, DKIM, and DMARC are all published correctly for your sending domain; this DMARC, DKIM and SPF setup guide walks through each record. Strong authentication records are the foundation of good email deliverability, and no SMTP setting can compensate for missing ones.
Monitor before you scale
Once you're connected and sending, watch how mailbox providers treat your mail. Tools like Google Postmaster show reputation and spam-rate data for Gmail recipients; this overview of Google Postmaster Tools explains how to read those signals. Keeping an eye on reputation early saves you from a blacklisting you discover only after your reply rate collapses.
Get the ports right, use app passwords, respect the limits, and enable SMTP AUTH — that combination clears up the vast majority of Office 365 connection problems. If you're evaluating tools to run outreach through these mailboxes, our roundup of the best cold email software compares the options built to handle SMTP sending at scale.
