# Error: ErrorSendAsDenied (Microsoft 365)

Source: https://catalystgroup.gg/docs/email-delivery/error-send-as-denied/
Updated: 2026-10-19 · By Duane Garner

Microsoft 365 will not let the mailbox send with the From address you chose. Use a real mailbox's primary address as the From Email.

This article is for sites using the **365 / Outlook** mailer (Microsoft Graph) where a send fails with `ErrorSendAsDenied`.

 

> **The error as you see it:** `ErrorSendAsDenied: The user account which was used to submit this request does not have the right to send mail on behalf of the specified sending account.`
>  
> Shown by the **365 / Outlook** mailer, in the failed-send banner, in **Tools → Debug Events** and in the **Email Log**.

 

## What this error means

 

The **365 / Outlook** mailer sends as one mailbox: the address in **From Email** on **CRM-NG SMTP → Settings → General**. It asks Microsoft Graph to send from that mailbox and puts the same address in the From line. Graph found a mailbox, but Exchange Online decided the From address is not one that mailbox may send as. In practice the address you entered is not the mailbox's own primary address, so Exchange treats the message as an attempt to send as someone else.

 

## Common causes

 
- **The From Email is an alias** (a secondary address) of a mailbox. Graph finds the mailbox through the alias, but sending *as* the alias is refused unless your tenant allows sending from aliases.
- **The From Email is a group address**: a distribution list, a mail-enabled security group or a Microsoft 365 group. Groups are not mailboxes the app can send as.
- **The From Email is a mail contact or mail user** that points to an outside address.
- **The address belongs to a different tenant** or to a domain not added to your tenant.
- **The From Email is empty** and another plugin supplied a From address that is not a mailbox in your tenant.

 

## How to fix

 
1. Look up the address
  Open the Exchange admin center at `https://admin.exchange.microsoft.com/` and go to **Recipients → Mailboxes**. Search for the From Email. If it does not appear as a mailbox, check **Recipients → Groups** and **Recipients → Contacts**: that tells you what it really is.
2. Find the primary address
  Open the mailbox and look at its email addresses. Note the one marked as primary (shown as the main address, often in capitals as `SMTP:` in the address list).
3. Pick a real mailbox if needed
  For a group or contact address, choose a user mailbox or create a *shared mailbox* (**Recipients → Mailboxes → Add a shared mailbox**). Shared mailboxes need no licence and suit website mail well.
4. Allow aliases (optional)
  If you must send as an alias, your tenant needs sending from aliases turned on. A Microsoft 365 admin can enable it with Exchange Online PowerShell (`Set-OrganizationConfig -SendFromAliasEnabled $true`). Allow some time for it to apply.
5. Update CRM-NG SMTP
  In **CRM-NG SMTP → Settings → General**, set **From Email** to the mailbox's primary address. Tick **Force From Email** so other plugins cannot replace it, then press **Save Settings**.
6. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test**, fill in **Send To** and press **Send Email**.

 

## Verify it worked

 

The test page shows "Test email sent successfully! Check your inbox to confirm delivery." Open the From Email mailbox in Outlook: the test message is in **Sent Items**.

 

## Notes

 
- An Exchange Application Access Policy limits which mailboxes the app may use. If the mailbox is outside that policy the error is usually *access denied* rather than send-as denied, but check the policy if you recently created one.
- Set a friendly display name with **From Name**; the address is what Exchange checks.

 

## Related

 
- [Microsoft 365 / Outlook](https://catalystgroup.gg/docs/email-delivery/mailer-microsoft-365/)
- [Sender name, address and the Force settings](https://catalystgroup.gg/docs/email-delivery/sender-name-and-address/)
- [Error: MailboxNotEnabledForRESTAPI (Microsoft 365)](https://catalystgroup.gg/docs/email-delivery/error-mailbox-not-enabled-for-rest-api/)
- [Troubleshooting email delivery](https://catalystgroup.gg/docs/email-delivery/troubleshooting/)