535 5.7.139: Authentication unsuccessful (Microsoft 365)
Microsoft 365 refused to let your app or device sign in to send email. The message was never sent.
Sign-in problem Your app or device couldn't sign in to your own mail server, so the message was never sent. Fix the sign-in settings.
What the bounce message looks like
The wording changes from one provider to another. These are typical examples:
535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant. Visit https://aka.ms/smtp_auth_disabled for more information.535 5.7.139 Authentication unsuccessful, user is locked by your organization's security defaults policy.Common causes
- SMTP sending (SMTP AUTH) is turned off for your organization or your mailbox
- Security defaults block password-only sign-in
- Wrong username or password
How to fix it if you sent the email
- Tell your IT admin and send them the full error.
- If you set up a printer or app yourself, check the username is your full email address.
If you manage the receiving or sending mail system
- Turn on SMTP AUTH for the mailbox that sends, if your security policy allows it, or use another method such as an SMTP relay connector.
- Note that Microsoft is retiring password-based (Basic) SMTP AUTH; plan to move apps to OAuth or a connector.
Free tool: paste the full bounce into the bounce message decoder to get a plain-English reading of every code in it.
Questions people ask
- What does 535 5.7.139 mean?
- Microsoft 365 refused to let your app or device sign in to send email. The message was never sent.
- Is 535 5.7.139 a hard or soft bounce?
- Sign-in problem. Your app or device couldn't sign in to your own mail server, so the message was never sent. Fix the sign-in settings.
- Should I remove the address after a 5.7.139 bounce?
- No. The message never left your own mail server. Fix the sign-in or sender settings and send again.