We have implemented SMTP emails in our application using nodemailer npm library. In the Initial implementation, we use plain auth with username and password to authorise on SMTP. Many customers use this feature with multiple email providers like Microsoft, Google, mailgun etc.

Recently Microsoft announced to deprecate plain auth for SMTP by March2026 and recommended to use oauth token instead. Therefore we have added the implementation to authorize on SMTP using client_credentials oauth token using Microsoft Entra application and smtp permissions. Email are working perfectly fine if from_address is in-tenant email.

const nodemailer = require('nodemailer');

transporterObject = {
      host: smtp_host,
      port: smtp_port,
      secure: false,
      auth: {
        type: 'OAuth2',
        user: microsoft_mailbox_email,
        accessToken: smtpToken,
      },
      tls: {
        ciphers: 'SSLv3',
      },
    };
const transporter = nodemailer.createTransport(transporterObject);

const mailOptions = {
      from: microsoft_mailbox_email,
      to: ToAddresses,
      subject: Email_Subject,
      html: html_body,
    };

const response = await transporter.sendMail(mailOptions);

But we observe with client_credentials oauth token that if we use from_address of a external domain(outside of microsoft). Emails are block with the following error.

554 5.2.252 SendAsDenied; testgroups@domain1.net not allowed to send as abhishek.shakya@domain2.net; STOREDRV.Submission.Exception:SendAsDeniedException.MapiExceptionSendAsDenied; Failed to process message due to a permanent exception with message [BeginDiagnosticData]Cannot submit message

Whereas we are able to use external domain as sender with plain login(username and password) even with Microsoft emails.

I have explore microsoft documents a lot but couldn't find the reason behind this. Is it expected behaviour with client_credentails oauth token ? Why external domains are blocked ? What is the way forward to use external domain as from_address with Microsoft SMTP emails.