Talk to our team

Documentation

✉️ Email Delivery

Documentation, reference material and tutorials for CRM-NG SMTP Email: setup guides for every mail service, troubleshooting, and one article per error message.

Microsoft 365 / Outlook

Updated

By Duane GarnerChief Executive Officer (CEO)
Summarize: Claude ChatGPT View Markdown
On this page

Send WordPress email through a Microsoft 365 mailbox using Microsoft Graph and an app registration in Microsoft Entra ID.

This guide is for organisations that run their email on Microsoft 365 and want the website to send from one of their mailboxes. It needs someone who can register apps and grant admin consent in your Microsoft tenant.

The 365 / Outlook mailer sends through Microsoft Graph rather than SMTP, so it keeps working in tenants where SMTP sign-in with a password is switched off. It uses app-only sign-in (also called client credentials): the site proves who it is with a tenant ID, an application ID and a client secret. No person signs in, and there is no redirect step.

Personal Outlook.com accounts

This mailer needs a Microsoft 365 work or school tenant. A free Outlook.com or Hotmail account has no tenant to register an app in, so pick another mailer. See Choosing a mail service.

Before you start

  • A Microsoft 365 mailbox that will send the email (a user mailbox or a shared mailbox), with an Exchange Online licence or a shared mailbox in Exchange Online.
  • A Microsoft Entra ID role that can register apps and grant admin consent, such as Application Administrator or Global Administrator.
  • Administrator access to your WordPress site.

Step 1: Register the app in Microsoft Entra ID

  1. Open the Entra admin center

    Go to https://entra.microsoft.com/ and sign in as an administrator.

  2. Start a new registration

    Open Identity → Applications → App registrations (the menu may simply say App registrations) and choose New registration.

  3. Name it and pick the account type

    Enter a name such as "Website mail". Under supported account types choose Accounts in this organizational directory only (single tenant). Leave Redirect URI empty; this mailer does not use one.

  4. Register and note the IDs

    Press Register. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.

Step 2: Grant the Mail.Send permission

  1. Add a permission

    In the app, open API permissions and choose Add a permission → Microsoft Graph → Application permissions. Do not pick Delegated permissions.

  2. Pick Mail.Send

    Search for Mail.Send, tick it, and press Add permissions.

  3. Grant admin consent

    Back on the list, press Grant admin consent for (your organisation) and confirm. The status column should show a green tick with "Granted".

  4. Remove extras

    The app only needs Mail.Send. You can remove the default delegated User.Read permission if you like.

Step 3: Create a client secret

  1. Open the secrets page

    In the app, open Certificates & secrets → Client secrets and choose New client secret.

  2. Set an expiry

    Add a description and choose how long the secret lasts. Note the date in your calendar: sending stops when the secret expires.

  3. Copy the Value

    Press Add, then copy the text in the Value column straight away. Microsoft shows it once. Do not copy the Secret ID; that is a different value and will not work.

Step 4: Limit which mailboxes the app can send as

By default, an app with the Mail.Send application permission can send as any mailbox in your tenant. Limit it to the mailbox the website uses.

  1. Create a mail-enabled security group

    In the Exchange admin center, create a mail-enabled security group and add the sending mailbox to it.

  2. Apply the restriction

    In Exchange Online PowerShell, create an application access policy that ties the app's Application (client) ID to that group with the access right RestrictAccess. Microsoft also offers a newer method called Role Based Access Control for Applications in Exchange Online; either one works, so follow the method your tenant uses.

  3. Test the policy

    Microsoft's test command for the policy should report "Granted" for the website mailbox and "Denied" for another mailbox. Changes can take up to an hour to take effect.

Step 5: Connect in CRM-NG SMTP

  1. Choose the mailer

    In WordPress, open CRM-NG SMTP → Settings → General and set Mailer to 365 / Outlook.

  2. Set the From Email

    Set From Email to the exact address of the mailbox the app may send as, and tick Force From Email. CRM-NG SMTP always sends as the mailbox in this field, whatever address another plugin asks for.

  3. Enter the tenant

    Paste the Directory (tenant) ID into Tenant ID. Your tenant domain, such as yourcompany.onmicrosoft.com, also works.

  4. Enter the app details

    Paste the Application (client) ID into Application (Client) ID and the secret's Value into Client Secret.

  5. Save

    Press Save Settings. There is no authorise button: the site asks Microsoft for a sending token each time it needs one.

Each message is also saved in the Sent Items folder of the sending mailbox, so you can see what the site sent from Outlook.

Send a test email

Open CRM-NG SMTP → Tools → Email Test, enter your address in Send To, and press Send Email. Check that the message arrives from the mailbox you set, and that a copy appears in that mailbox's Sent Items. See Sending a test email.

For good inbox placement, your domain needs SPF with spf.protection.outlook.com, DKIM switched on in Microsoft Defender, and a DMARC record. See Adding DNS records.

Troubleshooting

Go to Top