How to Send WordPress Emails with Microsoft 365 (Outlook) Using Microsoft Graph

If your business email runs on Microsoft 365 (Outlook / Exchange Online), the reliable way to send WordPress emails from it is Microsoft Graph, not SMTP with a password. You register an app in Microsoft Entra (the new name for Azure Active Directory), give it permission to send mail, and connect it to a plugin. The free plugin I use for this is WPO365 | Microsoft 365 Graph Mailer.

Why not just put smtp.office365.com and the mailbox password into an SMTP plugin? Because Microsoft is retiring Basic authentication for SMTP AUTH (sending with a username and password). Its current plan is to turn it off by default from December 2026, and many tenants already have SMTP AUTH disabled. Graph uses modern sign-in (OAuth), so it keeps working.

If you cannot pay for a premium mail plugin, the free WPO365 Graph Mailer covers everything a normal site needs. This guide follows the plugin's official documentation, plus the problems I ran into.

Quick steps: WordPress email with Microsoft 365

1. Deactivate any other mail/SMTP plugin.
2. Install WPO365 | Microsoft 365 Graph Mailer and click Configure (or open WPO365 > Mail).
3. In Microsoft Entra, create an app registration with your site's redirect URI.
4. Add the Microsoft Graph delegated permission Mail.Send and grant admin consent.
5. Create a client secret and copy its Value.
6. Paste the tenant ID, client ID and secret into the plugin.
7. Enter the From mailbox, click Authorize, and sign in.
8. Send a test email.

What you need before you start

• A Microsoft 365 mailbox to send from, for example [email protected]. It needs a license with a mailbox (a shared mailbox is possible, see below).
• An account that can register apps and grant admin consent in Entra, usually a Global Administrator. If you build sites for clients, ask the client's IT person to do Steps 2 to 4 with you on a call.
• WordPress administrator access.

Step 1: Install the plugin and copy the redirect URI

1. In WordPress, go to Plugins > Add New and search for WPO365 Microsoft 365 Graph Mailer (by Marco van Wieren).
2. Install and activate it.
3. Click Configure under the plugin name, or open WPO365 > Mail in the admin menu.
4. Copy the Redirect URI the plugin shows. It is normally your site's home address, such as https://yourdomain.com/. You will paste this exact value into Entra.

Keep this tab open; you come back to it in Step 5.

Step 2: Register an app in Microsoft Entra (Azure)

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) or the Azure portal.
2. Go to App registrations and click New registration.
3. Name: something you will recognise later, like WordPress mail - yourdomain.com.
4. Supported account types: Accounts in this organizational directory only.
5. Redirect URI: choose Web and paste the redirect URI from the plugin, exactly as shown (the trailing slash matters).
6. Click Register.

On the app's Overview page, note the Application (client) ID and the Directory (tenant) ID.

The plugin's documentation also asks you to add the optional ID token claims email and upn: open Token configuration > Add optional claim, choose ID, tick both, and click Add (accept if it asks to add the related permissions).

Step 3: Give the app permission to send mail

1. Open API permissions and click Add a permission.
2. Choose Microsoft Graph > Delegated permissions.
3. Make sure openid, profile, email, offline_access and User.Read are ticked.
4. Under Mail, tick Mail.Send.
5. Click Add permissions.
6. Click Grant admin consent for [your organisation] and confirm. The status column should show green ticks.

Delegated means the app can only send as the mailbox that signs in and authorizes it (Step 5). That is the safer choice and the one the plugin recommends.

What about application permissions?

You can also add Mail.Send as an Application permission. Then the plugin does not need anyone to sign in, but the app can send mail as any user in your organisation. If your WordPress site is ever hacked, the attacker could send email as your CEO. Use it only if you really need to send from several mailboxes, and then limit it: the plugin supports RBAC for Exchange Online, which restricts the app to one specific mailbox using a few Exchange Online PowerShell commands. For a single website mailbox, stay with delegated permissions.

Step 4: Create a client secret

1. Open Certificates & secrets and click New client secret.
2. Add a description, such as WordPress mail, and choose an expiry. The default is 180 days; you can choose longer, up to 24 months.
3. Click Add.
4. Copy the Value immediately. Do not copy the Secret ID, which looks similar but does not work. The value is shown only once; if you leave the page, create a new secret.

Step 5: Configure WPO365 and authorize the mailbox

Back on WPO365 > Mail:

1. Turn on Enable sending emails with Microsoft Graph (the wording can differ slightly by version).
2. Paste the Directory (tenant) ID, Application (client) ID and the Application (client) secret. Leave the Redirect URI as it is.
3. If the plugin says it cannot find an existing configuration, ignore it and continue.
4. In the default From address, enter the mailbox that will send, for example [email protected].
5. Click Authorize next to it, and Authorize again in the dialog.
6. Sign in as that mailbox (with MFA if it is on) and accept.

You return to WordPress and should see Authorized!

Step 6: Send a test email

On the same page, enter an address in To (and optionally CC/BCC), and click Save configuration + Send test email.

• It arrives: done. The plugin also saves sent mail in the mailbox's Sent Items by default, which is handy for checking what the site sent.
• It fails: read the error the plugin shows, or its health messages. For more detail, enable the plugin's debug log, send the test again and download the log.
• "Sent" but nothing arrives at an outside address: a new or trial Microsoft 365 tenant (under about 90 days) can be limited in sending to outside addresses. Microsoft support can lift the limit.

When you have to authorize again

The plugin refreshes its token automatically every day, so normally you authorize once and forget it. But Microsoft cancels that permission when the security of the sending account changes:

• the mailbox password is changed or reset;
• MFA for the account is reset or changed;
• a Conditional Access policy that applies to the account is changed, for example stricter sign-in rules.

Then emails stop and the plugin shows an error like:

AADSTS50173: The provided grant has expired due to it being revoked,
a fresh auth token is needed. The user might have changed or reset their password.

Fix: open WPO365 > Mail, click Authorize, sign in as the mailbox again, and send a test email.

In companies with strict security policies, this can happen more often than you would like. Tell the client's IT team which account the website uses, and ask them to let you know when they change its password or sign-in rules. Otherwise you find out when the leads stop.

And when the client secret expires

The secret is separate from the sign-in. When it expires:

1. In Entra, open the app's Certificates & secrets and create a new secret.
2. Paste the new Value into WPO365 > Mail and save.
3. Send a test email, then delete the old secret in Entra.

Shared mailboxes, aliases and other premium options

The free plugin sends from the authorized mailbox. Sending from a shared mailbox, as another user, from an alias, a separate reply-to, a full mail log with resend, and attachments over 3 MB are part of the paid WPO365 | MAIL extension.

A cheap trick for many small sites: let the website send from the licensed mailbox, and set your contact form's reply-to to the visitor's email. When you click Reply, it goes to the visitor, and you do not need any premium feature.

Common errors

Frequently asked questions

Can I still use smtp.office365.com with a password?

Only while your tenant allows Basic authentication for SMTP AUTH. Microsoft plans to turn it off by default from December 2026, and many tenants already have it disabled. Microsoft Graph with OAuth is the long-term option.

Is WPO365 Graph Mailer free?

Yes. Sending through Microsoft Graph, delegated or application permissions, test emails, Sent Items and attachments up to 3 MB are free. Shared mailboxes, aliases, mail logs and large attachments need the paid extension.

Why do I have to authorize the plugin again?

Microsoft revokes the sign-in when the mailbox password, MFA or Conditional Access rules change. Click Authorize in WPO365 > Mail and sign in again.

What happens when the client secret expires?

The plugin can no longer get tokens and emails stop. Create a new secret in Entra, paste its Value in the plugin, and save.

Should I use delegated or application Mail.Send?

Delegated, for almost every site. Application permission lets the app send as anyone in your organisation, so use it only when you need several senders, and restrict it with RBAC for Exchange Online.

For other email problems and cPanel SMTP settings, see WordPress not sending emails. If you use Google instead, see WordPress Gmail SMTP.