clement
Try free for 14 days

535 5.7.139: SMTP AUTH is disabled for the tenant (Microsoft 365)

Microsoft 365 refused the SMTP login because authenticated SMTP (SMTP AUTH) is turned off for the organization or mailbox.

Bounce type
Hard bounce (permanent)
What to do
Fix your setup, keep the contact
Returned by
Microsoft (Outlook.com, Microsoft 365)

What 535 5.7.139 means

Microsoft returns 535 5.7.139 'Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant' when a client tries to log in to smtp.office365.com but authenticated SMTP submission is switched off. Microsoft recommends keeping SMTP AUTH off for the organization and enabling it only on mailboxes that need it, and it's always off when security defaults are enabled.

A related form says the user credentials were incorrect. Either way, nothing was sent.

What the bounce looks like

The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.

Microsoft
535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant.

Why cold emailers see 535 5.7.139

  • SMTP AUTH disabled organization-wide in the Exchange admin center.
  • SMTP AUTH disabled on the specific mailbox.
  • Security defaults turned on, which block legacy authentication.

How to fix 535 5.7.139

  1. In the Microsoft 365 admin center, go to Users > Active users, select the user, then Mail > Manage email apps, and check Authenticated SMTP.
  2. If security defaults are on, SMTP AUTH stays disabled regardless; the admin has to turn security defaults off or you need OAuth.
  3. Use OAuth if your sending tool supports it for Microsoft 365.
  4. Changes can take a while to apply. If the login still fails right after enabling Authenticated SMTP, wait and try again before changing anything else.

Retry or suppress?

Don't suppress anyone. Enable SMTP AUTH or switch to OAuth, then resend.

Reading the code

The basic code 535 means "Authentication credentials invalid" under RFC 5321. In 5.7.139, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 139 isn't in the RFC 3463 / IANA registry; it's specific to the provider, so the text after the code carries the meaning.

Class 5
Permanent failure
Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
Subject 7
Security or policy
A security or policy decision: spam filtering, authentication, blocklists, permissions.
Detail 5.7.139
Provider-specific

Check the rest of your setup

Paste the headers of a message that did get through into the email header analyzer to confirm SPF, DKIM and DMARC pass, and check your domain with the SPF, DKIM & DMARC checker. The deliverability checklist covers the rest of a healthy sending setup.

Got a different bounce? Paste it into the SMTP error code lookup to decode it.

FAQ

Is 535 5.7.139 a hard bounce or a soft bounce?

535 5.7.139 is a permanent failure (a hard bounce): the receiving server won't accept this message if you send it again unchanged. But the cause is not the recipient's address, so treat it differently from a 'user unknown' bounce.

Should I remove the contact after a 535 5.7.139 bounce?

No. Don't suppress anyone. Enable SMTP AUTH or switch to OAuth, then resend.

What does 5.7.139 mean in the error code?

In 5.7.139, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 139 isn't in the RFC 3463 / IANA registry; it's specific to the provider, so the text after the code carries the meaning.

Related SMTP codes

See all SMTP error codes

Sources

Try Clement free for 14 days

Clement reads the bounces that land in your Gmail and SMTP inboxes and tells dead addresses apart from policy blocks: it suppresses the first across every campaign and keeps the contact on the second, so you don't have to decode bounces by hand.

Start free trial