[Bug]Personal Outlook account (Graph) cannot send: Authentication failed for smtp.office365.com:587

[Paula129419]

Where in the app

Compose / send — drafts, replies, sending, Sent folder

What happened

An outlook.de account, connected with "Sign in with Microsoft", syncs
and reads fine. Sending fails every time with:

"Authentication failed for smtp.office365.com:587 — check your email
and password."

The account shows as authenticated via OAuth2, and the SMTP settings
cannot be edited for this account type, so I found no workaround.
The FAQ lists reading, deleting, moving and backup for Graph accounts,
but does not mention sending as unavailable.

Possible cause, from reading the source: Graph accounts get a token
with the scopes "Mail.ReadWrite Mail.Send" (src-core/src/oauth2.rs),
but composeSend.js still sends through smtp_send_email, which uses
XOAUTH2 against smtp.office365.com with that Graph token. I could not
find a Graph sendMail call in graph.rs. I assume the SMTP server
rejects the token because it lacks the SMTP.Send scope; I have not
seen the raw server response. Microsoft also documents
smtp-mail.outlook.com, not smtp.office365.com, for personal accounts.

What you expected instead

Mail from a personal Outlook account is sent, e.g. through Graph
(POST /me/sendMail).

Steps to reproduce

1. Add a personal Microsoft account (outlook.de) via Sign in with Microsoft.
2. Compose a message from that account and send it.
3. The send fails with the authentication error above.

MailVault version

2.18.1

Operating system

macOS (Apple Silicon)

OS version

27.0.1

How you installed it

DMG from mailvaultapp.com

Mail provider

Outlook.com / Hotmail (personal)

How you sign in to it

Sign in with Microsoft (OAuth2)

How many accounts it affects

One account only

How often it happens

Every time

Did any mail get lost?

No — nothing is missing

Logs and screenshots

Before you post

• I'm on the latest release and checked the changelog
• I searched Bug Reports for the same thing
• No passwords, tokens, or other people's addresses in this report

[rokas-ambrazevicius]

Fixed in 2.19.0, out now. Update from the app or download it from mailvaultapp.com.

Your reading of the source was right. Accounts added with "Sign in with Microsoft" get a token for Microsoft Graph (Mail.ReadWrite Mail.Send), but sending still went to smtp.office365.com over XOAUTH2 with that token. SMTP needs a token for a different resource, so the server refused it every time. Switching to smtp-mail.outlook.com would not have helped, for the same reason.

What changed in 2.19.0:

• Mail from these accounts now goes through Graph (POST /me/sendMail). That covers normal sends, replies, forwards and scheduled sends.
• Outlook files the message in Sent Items itself, and Sent shows it once.
• When Microsoft refuses a send, the error now says why: sign in to the account again, or the address is not one the account may send as. It no longer blames the password.
• A scheduled email whose sign-in expired while the app was closed renews the sign-in first, and waits for the network if the computer has only just woken.

One limit for now: a message over about 4 MB (attachments included) cannot be sent from these accounts yet. Graph caps a single send request at 4 MB, and the app says so instead of failing silently. Bigger messages need a different route through Graph, which I'm working on.

If you send with Bcc, please let me know whether the Bcc recipients get their copy. It works against our test server, but I'd like a confirmation from a real Outlook.com mailbox.

Thanks for the detailed report and the pointer to the source.

[Paula129419]

Thanks, 2.19.0 fixes it. Sending from my outlook.de account works now.

Bcc confirmed with a real Outlook.de mailbox: the Bcc recipient received the copy.

[rokas-ambrazevicius]

Thanks for confirming – I’ve double-checked it too, just to be on the safe side. The development environment isn’t always reliable, so it’s good to be sure. I’m also looking into a fix for the 4 MB limit.

Our focus timer has gained some lovely new animations as well – cheers! 😊