# Microsoft 365 / Outlook Source: https://catalystgroup.gg/docs/email-delivery/mailer-microsoft-365/ Updated: 2026-10-19 · By Duane Garner Send WordPress email through a Microsoft 365 mailbox using Microsoft Graph and an app registration in Microsoft Entra ID. This guide is for organisations that run their email on Microsoft 365 and want the website to send from one of their mailboxes. It needs someone who can register apps and grant admin consent in your Microsoft tenant. The **365 / Outlook** mailer sends through Microsoft Graph rather than SMTP, so it keeps working in tenants where SMTP sign-in with a password is switched off. It uses app-only sign-in (also called client credentials): the site proves who it is with a tenant ID, an application ID and a client secret. No person signs in, and there is no redirect step. > **Personal Outlook.com accounts:** This mailer needs a Microsoft 365 work or school tenant. A free Outlook.com or Hotmail account has no tenant to register an app in, so pick another mailer. See [Choosing a mail service](https://catalystgroup.gg/docs/email-delivery/choose-a-mailer/). ## Before you start - A Microsoft 365 mailbox that will send the email (a user mailbox or a shared mailbox), with an Exchange Online licence or a shared mailbox in Exchange Online. - A Microsoft Entra ID role that can register apps and grant admin consent, such as Application Administrator or Global Administrator. - Administrator access to your WordPress site. ## Step 1: Register the app in Microsoft Entra ID 1. Open the Entra admin center Go to `https://entra.microsoft.com/` and sign in as an administrator. 2. Start a new registration Open **Identity → Applications → App registrations** (the menu may simply say **App registrations**) and choose **New registration**. 3. Name it and pick the account type Enter a name such as "Website mail". Under supported account types choose **Accounts in this organizational directory only** (single tenant). Leave **Redirect URI** empty; this mailer does not use one. 4. Register and note the IDs Press **Register**. On the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. ## Step 2: Grant the Mail.Send permission 1. Add a permission In the app, open **API permissions** and choose **Add a permission → Microsoft Graph → Application permissions**. Do not pick Delegated permissions. 2. Pick Mail.Send Search for `Mail.Send`, tick it, and press **Add permissions**. 3. Grant admin consent Back on the list, press **Grant admin consent for (your organisation)** and confirm. The status column should show a green tick with "Granted". 4. Remove extras The app only needs `Mail.Send`. You can remove the default delegated `User.Read` permission if you like. ## Step 3: Create a client secret 1. Open the secrets page In the app, open **Certificates & secrets → Client secrets** and choose **New client secret**. 2. Set an expiry Add a description and choose how long the secret lasts. Note the date in your calendar: sending stops when the secret expires. 3. Copy the Value Press **Add**, then copy the text in the **Value** column straight away. Microsoft shows it once. Do not copy the **Secret ID**; that is a different value and will not work. ## Step 4: Limit which mailboxes the app can send as By default, an app with the `Mail.Send` application permission can send as **any** mailbox in your tenant. Limit it to the mailbox the website uses. 1. Create a mail-enabled security group In the Exchange admin center, create a mail-enabled security group and add the sending mailbox to it. 2. Apply the restriction In Exchange Online PowerShell, create an application access policy that ties the app's Application (client) ID to that group with the access right `RestrictAccess`. Microsoft also offers a newer method called Role Based Access Control for Applications in Exchange Online; either one works, so follow the method your tenant uses. 3. Test the policy Microsoft's test command for the policy should report "Granted" for the website mailbox and "Denied" for another mailbox. Changes can take up to an hour to take effect. ## Step 5: Connect in CRM-NG SMTP 1. Choose the mailer In WordPress, open **CRM-NG SMTP → Settings → General** and set **Mailer** to **365 / Outlook**. 2. Set the From Email Set **From Email** to the exact address of the mailbox the app may send as, and tick **Force From Email**. CRM-NG SMTP always sends as the mailbox in this field, whatever address another plugin asks for. 3. Enter the tenant Paste the Directory (tenant) ID into **Tenant ID**. Your tenant domain, such as `yourcompany.onmicrosoft.com`, also works. 4. Enter the app details Paste the Application (client) ID into **Application (Client) ID** and the secret's Value into **Client Secret**. 5. Save Press **Save Settings**. There is no authorise button: the site asks Microsoft for a sending token each time it needs one. Each message is also saved in the **Sent Items** folder of the sending mailbox, so you can see what the site sent from Outlook. ## Send a test email Open **CRM-NG SMTP → Tools → Email Test**, enter your address in **Send To**, and press **Send Email**. Check that the message arrives from the mailbox you set, and that a copy appears in that mailbox's **Sent Items**. See [Sending a test email](https://catalystgroup.gg/docs/email-delivery/send-a-test-email/). For good inbox placement, your domain needs SPF with `spf.protection.outlook.com`, DKIM switched on in Microsoft Defender, and a DMARC record. See [Adding DNS records](https://catalystgroup.gg/docs/email-delivery/dns-records/). ## Troubleshooting - The token is refused or has expired: [InvalidAuthenticationToken](https://catalystgroup.gg/docs/email-delivery/error-invalid-authentication-token/) - The app is not allowed to send as that mailbox: [ErrorSendAsDenied](https://catalystgroup.gg/docs/email-delivery/error-send-as-denied/) - The mailbox is not in Exchange Online or not licensed: [MailboxNotEnabledForRESTAPI](https://catalystgroup.gg/docs/email-delivery/error-mailbox-not-enabled-for-rest-api/) - The tenant value is wrong or set to a shared endpoint: [AADSTS50194](https://catalystgroup.gg/docs/email-delivery/error-aadsts50194-single-tenant/) - A header in the message is rejected: [InvalidInternetMessageHeader](https://catalystgroup.gg/docs/email-delivery/error-invalid-internet-message-header/) - The token request is malformed (often a wrong secret or ID): [400 invalid_request](https://catalystgroup.gg/docs/email-delivery/error-400-invalid-request/) - Access refused in general: [401 Unauthorized or Forbidden](https://catalystgroup.gg/docs/email-delivery/error-401-unauthorized-or-forbidden/) - Mail arrives in spam: [Emails landing in spam](https://catalystgroup.gg/docs/email-delivery/emails-landing-in-spam/) ## Related - [Choosing a mail service](https://catalystgroup.gg/docs/email-delivery/choose-a-mailer/) - [Sender name, address and the Force settings](https://catalystgroup.gg/docs/email-delivery/sender-name-and-address/) - [Securing settings with wp-config constants](https://catalystgroup.gg/docs/email-delivery/secure-settings-constants/) - [Adding DNS records: SPF, DKIM and DMARC](https://catalystgroup.gg/docs/email-delivery/dns-records/) - [Debug events](https://catalystgroup.gg/docs/email-delivery/debug-events/)