email sending over office365 (smtp-mail.outlook.com) with oauth client_credentials_flow not working

[giuseppCl]

Hello,

I have set up an Azure App Registration to send emails using Microsoft services via the client_credentials flow. I am utilizing this application for this purpose.

Working Workflow with Microsoft Graph API:

I request a token using the following command

curl -X POST "https://login.microsoftonline.com/$TENANT_ID/oauth2/v2.0/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_crede
ntials&client_id=$CLIENT_ID&client_secret=$SECRET&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default"

With the obtained token, I can successfully send an email using the Microsoft Graph API:

curl -v -X POST "https://graph.microsoft.com/v1.0/users/$SENDER_EMAIL/sendMail" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"message": {
"subject": "Subject of the email",
"body": {
"contentType": "Text",
"content": "This is the content of the email."
},
"toRecipients": [
{
"emailAddress": {
"address": "$RCPT_EMAIL"
}
}
]
}
}'

This approach works perfectly.

---

Problem with SMTP and Scope https://outlook.office365.com/.default:

However, when I use the scope https://outlook.office365.com/.default to send emails via SMTP (smtp-mail.outlook.com), authentication fails. The server and configuration used are as follows:

Despite correct credentials and using the same Azure App Registration, I receive the following error when attempting to send emails:

535 5.7.139 Authentication unsuccessful, the request did not meet the criteria to be authenticated successfully.

I have also followed these steps using PowerShell:

1. Created a new service principal:

New-ServicePrincipal -AppId "APP_ID" -ServiceId "OBJECT_ID"

2. Updated the service principal with a display name:

Set-ServicePrincipal -Identity "OBJECT_ID" -DisplayName "email-oauth-proxy"

3. Granted the service principal full access to the mailbox:

Add-MailboxPermission -Identity "SENDER_EMAIL" -User "OBJECT_ID" -AccessRights FullAccess

Despite these steps, the issue with SMTP authentication persists.

This is my emailproxy.config

[IMAP-1993]
server_address = outlook.office365.com
server_port = 993
local_address = 0.0.0.0

[POP-1995]
server_address = outlook.office365.com
server_port = 995
local_address = 0.0.0.0

[SMTP-1587]
server_address = smtp-mail.outlook.com
server_port = 587
server_starttls = True
local_address = 0.0.0.0

[[email protected]]
documentation = *** note: this is an advanced O365 account example; in most cases you want the version above instead ***
token_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token
oauth2_scope = https://outlook.office365.com/.default
oauth2_flow = client_credentials
client_id = CLIENT_ID
client_secret = SECRET

Im using the dockerzied setup:

services:
  emailproxy:
    image: blacktirion/email-oauth2-proxy-docker
    container_name: emailproxy
    volumes:
     - ./config:/config
    ports:
     - 1587:1587
    environment:
      LOGFILE: true
      DEBUG: true
      CACHE_STORE: /config/credstore.config

Does anyone know what I am doing wrong? Or does anyone have any tips or guesses for further debugging?

Thanks in advance!

[giuseppCl]

I also asked a question to the azure community:
https://learn.microsoft.com/en-us/answers/questions/2129942/email-sending-over-office365-(smtp-mail-outlook-co?comment=question#newest-question-comment

[simonrob]

It might help if you post the proxy's log in debug mode so that I can see what authentication method is actually being attempted.