Microsoft 365 IMAP and SMTP settings
Outlook.com, Hotmail and every Microsoft 365 tenant share the same endpoint family, but not the same hosts. Business mailboxes use outlook.office365.com; consumer accounts use the legacy outlook.com hosts.
outlook.office365.comport 993 · SSL/TLS
smtp.office365.comport 587 · STARTTLS
Username
your full email addressOutlook.com / Hotmail
Consumer accounts
imap-mail.outlook.com:993smtp-mail.outlook.com:587Microsoft 365
Business tenants
outlook.office365.com:993smtp.office365.com:587Connect in three steps
- 1
For Microsoft 365: register an app in Entra ID and use OAuth2 (XOAUTH2) — not a password.
- 2
For Outlook.com: enable 2-Step Verification and create an app password.
- 3
If you must use SMTP AUTH for a business mailbox, an admin has to enable it per mailbox: `Set-CASMailbox -SmtpClientAuthenticationDisabled $false`.
What usually breaks
Microsoft disabled basic authentication for Exchange Online IMAP/POP/SMTP in 2022. OAuth2 is the supported path.
Business tenants use `smtp.office365.com`; `smtp-mail.outlook.com` is the consumer endpoint.
Security defaults block SMTP AUTH on new tenants unless it is explicitly re-enabled.
Resolve it instead of hardcoding it
A custom domain on Microsoft 365 has the same MX infrastructure as the consumer product. That is what mailintel reads.
import { mailintel } from "mailintel";
const result = await mailintel("[email protected]");
result.provider; // "microsoft"
result.connection.imap; // { host: "outlook.office365.com", port: 993, security: "tls" }
result.connection.smtp; // { host: "smtp.office365.com", port: 587, security: "starttls" }
result.connection.username; // "[email protected]"What is Microsoft 365's IMAP server?+
outlook.office365.com on port 993 using SSL/TLS. The username is the full email address, and an app password is required when two-factor authentication is enabled.
What is Microsoft 365's SMTP server?+
smtp.office365.com on port 587 using STARTTLS. Most clients also accept the alternate submission port with STARTTLS.
Does Microsoft 365 need an app password?+
Yes, in practice. Microsoft 365 rejects normal account passwords for IMAP and SMTP once 2FA is on, so generate an app-specific password.
Which Microsoft 365 endpoint should I use?+
It depends on the account: Outlook.com / Hotmail (imap-mail.outlook.com / smtp-mail.outlook.com); Microsoft 365 (outlook.office365.com / smtp.office365.com). Match the region or product to the account.