535 5.7.139 Authentication unsuccessful, basic authentication is disabled

535 5.7.139 Authentication unsuccessful, basic authentication is disabled

Microsoft 365 refused username-and-password authentication. The credentials are almost certainly fine — the authentication method is switched off. Retyping the password, generating a new one, or recreating the mailbox will not change anything.

Check it from the machine that is failing

npx zerosmtp-check --explain "535 5.7.139 Authentication unsuccessful, basic authentication is disabled"

No install and nothing sent. It reads the refusal your own client printed - which is rarely what the server said, because libraries and device panels rewrite it - and says which of these cases you are in.

If the send is hanging rather than being refused, the cause is usually the network and not the credentials. npx zerosmtp-check with no arguments checks ports 25, 587 and 465 from where you are standing.

This does not mean your password is wrong. Nothing about the credentials changed; the method used to present them was switched off.

Which of the four causes is yours

Basic auth for SMTP AUTH gets refused in four situations, and the message the client shows is identical in all of them. Which one you are in decides whether this is a setting or a migration:

Cause	Can you turn it back on?
An admin disabled SMTP AUTH for the tenant or the mailbox	Yes — until the end of December 2026
Security Defaults, on by default for recently created tenants	Yes, but it disables more than SMTP and turning it off weakens the tenant
A Conditional Access policy blocking legacy authentication	Yes, by scoping the policy — but it is usually deliberate, so ask why it exists
The end-of-December-2026 default change	No

Before the end of December 2026 the first three are the likely answer, and the fix may be a checkbox rather than a project. After it, re-enabling stops being an option.

Find out which mailboxes are affected

Find-SmtpAuthExposure.ps1 answers this for your own tenant. It is read-only.

It exists because the one-liner everybody reaches for — Get-CASMailbox | Where SmtpClientAuthenticationDisabled -eq $false — misses every mailbox that inherits the tenant setting rather than carrying its own, and can therefore report zero on a tenant that is fully exposed. The script counts all three states separately.

The same error in other clothes

Libraries and device firmware rarely pass the server’s message through unchanged. These are the same refusal:

Python smtplib raises SMTPAuthenticationError: (535, b'5.7.139 ...'). The numeric code is split off into its own field and the rest arrives as a bytes literal, so searching for the message with 535 still in front of it returns nothing.
curl prints only curl: (67) Login denied and discards the server’s text entirely. There is nothing in that line about the tenant, the mailbox or Basic authentication, which is why it is usually mistaken for a wrong password. Add -v to see what the server actually said.
.NET - System.Net.Mail.SmtpClient, and therefore PowerShell’s Send-MailMessage - throws SmtpException with the server’s text discarded entirely and the message translated into the operating system’s language. Measured on a Polish system it reads “Uwierzytelnianie nie powiodlo sie”; on an English one, “Authentication failed”. Either way there is no 535, no 5.7.139 and nothing to search for, which is why this failure is usually reported as a wrong password.

Kyocera MFPs report it as send error 1102 / 0x1102, which looks like a hardware fault and is not one.

If it cannot be turned back on

Three options remain, and they differ more than they look:

OAuth on the device — check the exact model against the compatibility list. Several vendors have stated in writing that no firmware is coming for specific models.
Direct Send — free, but delivers only to recipients inside your own tenant, and needs a connector and a static IP.
A relay that still accepts a username and password — works for any recipient, and is three fields on the device.

The migration guide covers all of them, Graph API and paid relays included. ZeroSMTP is the third: free, no paid tier, 200 messages a day, and it sends from a shared @msgwing.com address rather than your own domain. If the from-address has to be yours, it is the wrong answer — the guide covers the others honestly.

Create a free account · settings by printer brand · code examples in 19 languages

Two things this is often confused with

Symptom	Actual cause
Connection times out; no authentication error ever appears	The network is blocking outbound SMTP. Cloud providers block port 25 and often 587 by default — see troubleshooting.
`Certificate verify failed` / `unable to get local issuer certificate`	The device’s trust store cannot validate the server certificate. Common on firmware predating current root CAs — see the Canon Maxify MB2755 case.

Seeing a string that is not here? Report it with what produced it. Errors from real hardware are worth more than anything transcribed from documentation.

Last reviewed 2026-08-16.

Updated 23 Aug 2026