Setting Up SMTP with OAuth 2.0 for Microsoft 365 (Exchange Online)

Setting Up SMTP with OAuth 2.0 for Microsoft 365 (Exchange Online)

This guide explains how to configure the Business Central SMTP connector to send email through Exchange Online (Microsoft 365) using OAuth 2.0 authentication and a dedicated Entra app registration. It is intended for administrators setting up email on Business Central SaaS where modern authentication (OAuth 2.0) is required instead of a basic password or app password.
Important: Most of this configuration is carried out in the Microsoft Entra admin center and Exchange Online PowerShell. You will need access to a Microsoft 365 account with both Global/Application Administrator and Exchange Administrator rights. If your organisation has an internal IT department, ask them to perform these steps.

How the Solution Fits Together

Sending email from Business Central through Exchange Online with OAuth 2.0 involves three pieces that must all be connected:
    Entra app registration — Business Central authenticates as this application.
    Exchange service principal — Exchange does not trust Entra applications directly, so an Exchange representation of the app must be created.
    Mailbox permissions — the service principal is then granted permission to send as the chosen mailbox.
Only once all three are in place will email send successfully. The end-to-end path is:
Business Central
   -> Entra app registration
   -> Exchange service principal
   -> Mailbox permissions
   -> Exchange Online SMTP
   -> Recipient

Step 1 - Create the App Registration

    Go to the Microsoft Entra admin center , then App registrations , and select New registration .
    Enter a Name , for example Business Central SMTP .
    For Supported account types , select Accounts in this organizational directory only .
    Select Register .
    From the app's Overview page, record the following values, as they are needed later:
  • Application (Client) ID
  • Directory (Tenant) ID

Step 2 - Create a Client Secret

    In the app registration, go to Certificates & secrets .
    Select New client secret , add a description and expiry, then select Add .
    Copy the secret Value immediately and store it securely.
The secret value is only shown once, at the moment it is created. If you navigate away without copying it, you will need to create a new secret.

Step 3 - Configure the Redirect URI

    In the app registration, go to Authentication .
    Select Add a platform , then Web .
    Add the following redirect URI:
https://businesscentral.dynamics.com/OAuthLanding.htm
    Select Configure / Save .
If this redirect URI is missing, Business Central returns the error AADSTS500113: No reply address is registered for the application, even when everything else is configured correctly.

Step 4 - Configure API Permissions

In the app registration, go to API permissions and add the following permissions exactly:
API
Permission
Type
Microsoft Graph
 User.Read 
Delegated
Office 365 Exchange Online
 Mail.Read 
Application
Office 365 Exchange Online
Mail.ReadWrite
Application
Office 365 Exchange Online
Mail.Send
Application
Office 365 Exchange Online
SMTP.SendAsApp
Application
Office 365 Exchange Online
User.Read.All
Application
After adding the permissions, select Grant admin consent. Each permission should then show a green tick confirming consent has been granted.

Step 5 - Install the Exchange Online PowerShell Module

The remaining steps use Exchange Online PowerShell cmdlets such as Connect-ExchangeOnline and New-ServicePrincipal, which are not available until the module is installed. In a PowerShell window, run:
Install-Module -Name ExchangeOnlineManagement -Force

Step 6 - Connect to Exchange Online

Connect using an account with Exchange administrator rights:
Connect-ExchangeOnline
Everything that follows is Exchange configuration. Configuring the app in Entra alone is not enough — Exchange stores its own half of the configuration, which is why this connection is required.

Step 7 - Create the Exchange Service Principal

This step creates an Exchange representation of the Entra application. Without it, authentication can succeed but email sending will still fail.
You will need two values:
  • The Application (Client) ID from the app registration (Step 1).
  • The Enterprise Application Object ID . In Entra, open Enterprise applications , find your app, and copy the Object ID shown there.
Use the Enterprise Application Object ID, not the app registration's Object ID. They are different values, and using the wrong one causes the service principal lookup to fail.
Run the following, substituting your own values:
New-ServicePrincipal `
    -AppId "[CLIENT_ID]" `
    -ObjectId "[ENTERPRISE_APPLICATION_OBJECT_ID]"
A successful run returns the new service principal's DisplayName, ObjectId and AppId.

Step 8 - Grant SendAs Permission

Grant the application permission to send email as the mailbox that Business Central will use:
Add-RecipientPermission `
    -Identity "[MAILBOX_EMAIL]" `
    -Trustee "[ENTERPRISE_APPLICATION_OBJECT_ID]" `
    -AccessRights SendAs
Without this permission, Exchange returns errors such as Cannot open mailbox, AuthenticationContext has no rights on this session, or SendAsDenied.

Step 9 - Verify the SendAs Permission

Confirm the permission was applied correctly:
Get-RecipientPermission "[MAILBOX_EMAIL]" |
    Where-Object {$_.Trustee -like "*[PARTIAL_OBJECT_ID]*"}
The result should show AccessRights : {SendAs}.

Step 10 - Verify SMTP AUTH Is Enabled

SMTP AUTH must be enabled on the mailbox. Check the current setting:
Get-CASMailbox "[MAILBOX_EMAIL]" |
    Format-List SmtpClientAuthenticationDisabled
The expected result is SmtpClientAuthenticationDisabled : False. If it returns True, SMTP authentication is disabled for the mailbox — enable it with:
Set-CASMailbox `
    -Identity "[MAILBOX_EMAIL]" `
    -SmtpClientAuthenticationDisabled $false

Step 11 - (Optional) Grant FullAccess Permission

In many environments, email sending works with SendAs alone. However, some Microsoft examples also grant FullAccess, which is useful when Exchange needs mailbox access beyond simple submission:
Add-MailboxPermission `
    -Identity "[MAILBOX_EMAIL]" `
    -User "[ENTERPRISE_APPLICATION_OBJECT_ID]" `
    -AccessRights FullAccess

Step 12 - Configure the Email Account in Business Central

    In Business Central, search for Email Accounts and select the related link.
    Select New , then choose the SMTP connector.
    Enter the following settings:
  • Server : smtp.office365.com
  • Port : 587
  • Secure Connection : STARTTLS
  • Authentication : OAuth 2.0
  • Tenant ID : the Directory (Tenant) ID from Step 1
  • Client ID : the Application (Client) ID from Step 1
  • Client Secret : the secret value from Step 2
  • User Name : the mailbox email address being configured
    Save the account, then send a test email to confirm the configuration is working.

Troubleshooting

Error
Cause / Fix
AADSTS500113: No reply address is registered for the application
The redirect URI is missing. Add  https://businesscentral.dynamics.com/OAuthLanding.htm  under Authentication (Step 3).
AADServicePrincipalNotFound
The Enterprise Application Object ID was not used. Re-run Step 7 using the Enterprise Application Object ID, not the app registration's Object ID.
Cannot open mailbox / AuthenticationContext has no rights on this session
SendAs permission is missing. Run Add-RecipientPermission (Step 8).
535 Authentication unsuccessful
Check the client secret, that admin consent was granted, the SMTP.SendAsApp permission, the Exchange service principal, and that SMTP AUTH is enabled.

Final Checklist

When everything is configured correctly:
  • Business Central authenticates successfully.
  • The OAuth login succeeds.
  • Exchange recognises the service principal.
  • The mailbox grants SendAs permission.
  • Email is sent through Microsoft 365 SMTP.


Globe with Meridians English (UK, IE, IM and IZ). To find documentation in other regions where Garage Hive operates, click  here.