Introduction

If you're managing an Exchange Online environment and encounter the dreaded 535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant error when configuring a scanner, printer, or application to send emails via SMTP, this error has become increasingly common as Microsoft tightens security around legacy authentication protocols.

This article provides a comprehensive guide to understanding and resolving this issue, with step-by-step instructions for IT administrators.

Understanding the Error

The 5.7.139 error indicates that SMTP AUTH (authenticated client submission) is disabled for your Microsoft 365 tenant. This is part of Microsoft's broader initiative to phase out Basic Authentication in favor of more secure Modern Authentication (OAuth 2.0).

Why Does This Happen?

Microsoft has implemented automated security measures that disable SMTP AUTH in tenants where no recent usage is detected. Additionally, for tenants created after January 2020, SMTP AUTH is disabled by default.

The Three-Layer Security Model

To successfully enable SMTP AUTH for a specific use case, you need to navigate through three distinct security layers:

Layer 1: Tenant-Level SMTP AUTH Setting

The organization-wide switch controlled by the SmtpClientAuthenticationDisabled parameter in the Transport Configuration.

Layer 2: Authentication Policies

Policies that define which legacy authentication protocols are permitted for specific users.

Layer 3: Conditional Access Policies

Microsoft Entra ID policies that can block legacy authentication across the board.

Step-by-Step Resolution Guide

Step 1: Check Current Configuration

First, connect to Exchange Online PowerShell and check the current settings:

# Check tenant-level SMTP AUTH setting

Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

# Check mailbox-level setting for the specific user

Get-CASMailbox -Identity "[email protected]" | Format-List SmtpClientAuthenticationDisabled

# Check assigned authentication policy

Get-User -Identity "[email protected]" | Format-List Name, AuthenticationPolicy

Step 2: Understand Security Defaults

If your tenant has Security Defaults enabled in Microsoft Entra ID, SMTP AUTH is disabled regardless of other settings. You have two options:

Option A: Disable Security Defaults

Option B: Use a Targeted Approach (Recommended)

Create a custom authentication policy that allows SMTP Basic Authentication for specific users while keeping Security Defaults enabled.

Step 3: Create an Authentication Policy

If you need to grant SMTP access to specific users, create a dedicated authentication policy:

# Create a policy that allows SMTP Basic Auth

New-AuthenticationPolicy "AllowSMTPForLegacyDevices" -AllowBasicAuthSmtp

# Assign the policy to a specific user

Set-User -Identity "[email protected]" -AuthenticationPolicy "AllowSMTPForLegacyDevices"

Step 4: Enable SMTP AUTH at the Mailbox Level

The most secure approach is to enable SMTP AUTH at the mailbox level while keeping it disabled tenant-wide:

# Enable SMTP AUTH for a specific mailbox

Set-CASMailbox -Identity "[email protected]" -SmtpClientAuthenticationDisabled $false

This mailbox-level override (false) takesprecedenceoverthetenant−levelsetting(true) when both are configured.

Step 5: Address Conditional Access Policies

If you have a Conditional Access policy that blocks legacy authentication, you need to exempt the specific user or service account:

Note

Optional: The High-Volume Email Alternative

For high-volume email scenarios, Microsoft has introduced the High Volume Email (HVE) Service. This service: