SMTP Relay Through Microsoft 365: Secure Setup Guide

This guide walks you through configuring a secure SMTP relay through Microsoft 365, letting you send email from printers, scanners, or on-premises applications without exposing your Microsoft credentials. You’ll set up a dedicated connector, create a mail-enabled contact for the relay, and configure your device with the correct endpoint, port, and authentication. By the end, your devices will send mail reliably while Microsoft 365 blocks unauthorized relay attempts.

What You’ll Need

Microsoft 365 admin access (Global Admin or Exchange Admin role)
A static public IP address or a certificate for the connector (if using IP-based auth)
The public IP address of your device or mail server
An email address that will appear as the sender (can be a shared mailbox or a dedicated user)
Basic familiarity with the Microsoft 365 admin center and Exchange admin center

Step-by-Step

Confirm your Microsoft 365 plan supports SMTP relay. SMTP relay is available in Microsoft 365 Business Premium, Enterprise E3/E5, and most education plans. If you’re on a Basic or Standard plan, you may need to upgrade or use a third-party relay.
Open the Exchange admin center. Go to admin.exchange.microsoft.com and sign in with an account that has Exchange Admin permissions.
Create a mail-enabled contact for the relay device. Navigate to Recipients → Contacts, click Add a contact, and fill in the display name and external email address. Use a real email address that can receive mail (e.g., the device’s own address) so that bounce-backs work. Save the contact.
Create a connector for inbound SMTP relay. In the Exchange admin center, go to Mail flow → Connectors, click Add a connector, and choose From: Your organization’s email server. Set To: Microsoft 365. Name it something like “SMTP Relay from Printer”.
Configure the connector’s authentication. Choose By verifying that the IP address of the sending server matches the list below. Enter the public IP address of your device or mail server. If you have multiple devices, add each IP. You can also use certificate-based authentication if you prefer, but IP-based is simpler for most setups.
Set the connector’s scope. Under Scoping, leave the default to accept mail from all domains, or restrict to specific domains if needed. Click Next and then Create.
Create a second connector for outbound relay (optional but recommended). Go back to Connectors, add another connector, choose From: Microsoft 365 and To: Your organization’s email server. This is only needed if you want to route outbound mail through your own server, which is not required for simple SMTP relay. Skip this if you just want devices to send mail.
Configure your device or application. Set the SMTP server to smtp.office365.com, port 587 for STARTTLS, or port 25 if you’re using the connector (but port 25 is often blocked by ISPs). Use the mail-enabled contact’s email address as the username and a generated app password (if using MFA) or the account’s password. For devices that don’t support authentication, use the connector’s IP-based relay: set the server to yourtenant.mail.protection.outlook.com (replace yourtenant with your tenant name) and port 25, and ensure the device’s public IP matches the connector.
Test the relay. Send a test email from your device to a personal inbox. Check the message headers to confirm it was relayed through Microsoft 365. Also check the Message Trace in the Exchange admin center (Mail flow → Message trace) to see if the message was accepted or rejected.
Monitor and harden. After a successful test, review the connector settings to ensure only your IPs are allowed. Consider enabling audit logging for the connector and setting up alerts for failed relay attempts.

Common Mistakes

Using the wrong endpoint: For authenticated relay, use smtp.office365.com:587. For IP-based relay, use yourtenant.mail.protection.outlook.com:25. Mixing these up causes connection failures.
Forgetting to create the mail-enabled contact: Without it, the relay may reject messages because the sender isn’t recognized.
Using a personal Microsoft account instead of a work account: SMTP relay requires a Microsoft 365 work or school account.
Not matching the public IP: If your device’s public IP changes (e.g., dynamic IP), the connector will fail. Use a static IP or update the connector regularly.
Leaving the connector open to all IPs: This creates an open relay that spammers can abuse. Always restrict to your specific IPs.
Using port 25 for authenticated relay: Port 25 is often blocked by ISPs and Microsoft doesn’t support authenticated SMTP on port 25. Use 587 with STARTTLS.

Tips

Use a dedicated user account for SMTP auth: Create a mailbox specifically for relay, enable MFA, and generate an app password. This avoids locking out a real user’s account.
Set a strong password and rotate it regularly: If you use a user account for SMTP auth, change the password periodically and update your devices.
Use the connector for devices that can’t do authentication: Printers and scanners often support only IP-based relay. The connector method is more secure than opening your firewall.
Test from the device’s network: Ensure you test from the same network the device will use, as the public IP must match the connector.
Document your settings: Note the connector name, IPs, and the contact email. This helps when troubleshooting later.

Troubleshooting

If your relay isn’t working, check the following in order:

Check the message trace: In Exchange admin center, go to Mail flow → Message trace. Search for the test email. If it shows “Failed” or “Rejected”, click the message to see the error code.
Verify your IP matches: Go to a site like whatismyip.com from the device’s network. Compare that IP to the one in your connector. If they differ, update the connector.
Test the connection manually: Use Telnet or a tool like swaks to test SMTP connectivity to smtp.office365.com:587 or your tenant’s endpoint. If you get a timeout, your ISP may be blocking port 25 or 587.
Check authentication: If using a user account, ensure the password is correct and that the account isn’t locked. If MFA is enabled, you must use an app password.
Look for connector errors: In the Exchange admin center, the connector’s status may show errors. Recreate the connector if needed.
Check DNS: Ensure your domain’s MX record points to Microsoft 365. If you’re using a third-party email filtering service, the relay may be intercepted.

Frequently Asked Questions

Can I use SMTP relay without a connector?

Yes, you can use authenticated SMTP relay with smtp.office365.com:587 and a mailbox with an app password. This doesn’t require a connector, but you must use a licensed mailbox.

What’s the difference between SMTP relay and SMTP submission?

SMTP relay (port 25) forwards mail from your devices to Microsoft 365, typically using IP authentication. SMTP submission (port 587) is for authenticated clients like Outlook, requiring a username and password.

Why is my device getting a 550 5.7.1 error?

This usually means the sender is not allowed. Check that you’ve created the mail-enabled contact and that your IP is in the connector. Also verify the sender address matches the contact’s email.

Can I send to external recipients using this relay?

Yes, Microsoft 365 will relay to external recipients as long as the connector is configured correctly. The mail-enabled contact should be an internal address, but the recipients can be external.

Do I need a static IP for the connector?

Yes, for IP-based authentication, the sending IP must be static. If your IP is dynamic, use certificate-based authentication or update the connector each time your IP changes.

How do I create an app password for SMTP auth?

Sign in to your Microsoft account security page, enable MFA, then go to App passwords and generate one. Use that password in your device’s SMTP settings.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →