Is 535 5.7.3 a hard bounce or a soft bounce?

535 5.7.3 is a permanent failure (a hard bounce): the receiving server won't accept this message if you send it again unchanged. But the cause is not the recipient's address, so treat it differently from a 'user unknown' bounce.

Should I remove the contact after a 535 5.7.3 bounce?

No. Don't suppress anyone. Fix the login, then resume.

535 5.7.3 Microsoft 365 Error: Meaning and Fix

What 535 5.7.3 means

Microsoft 365 returns 535 5.7.3 'Authentication unsuccessful' when an SMTP client fails to log in to smtp.office365.com. RFC 3463 defines 5.7.3 as 'Security conversion required but not possible', but in practice Microsoft uses this code as its generic SMTP login failure.

Nothing was sent. The fix is on your side: credentials, account settings or tenant policy.

What the bounce looks like

The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.

Microsoft

535 5.7.3 Authentication unsuccessful

Why cold emailers see 535 5.7.3

Wrong password, or the username doesn't match the mailbox's primary address.
Multi-factor authentication or security defaults blocking basic password logins.
SMTP AUTH turned off for the mailbox or tenant (often shown as 535 5.7.139 instead).
A sign-in flagged as risky that needs to be confirmed in the account's recent activity.

How to fix 535 5.7.3

Re-check the username (full address) and password, and sign in to the web mailbox to confirm the account works.
Check Entra ID sign-in logs for the failure reason.
Ask your admin whether SMTP AUTH is enabled for the mailbox and whether security defaults or conditional access block it.
Prefer OAuth where your sending tool supports it.
Test the login with the same settings from another client to separate a tool problem from an account problem.

Retry or suppress?

Don't suppress anyone. Fix the login, then resume.

Reading the code

The basic code 535 means "Authentication credentials invalid" under RFC 5321. In 5.7.3, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 3 is registered in RFC 3463 / the IANA registry as "Security conversion required but not possible".

Class 5: Permanent failure; Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
Subject 7: Security or policy; A security or policy decision: spam filtering, authentication, blocklists, permissions.
Detail 5.7.3: Security conversion required but not possible

Check the rest of your setup

Paste the headers of a message that did get through into the email header analyzer to confirm SPF, DKIM and DMARC pass, and check your domain with the SPF, DKIM & DMARC checker. The deliverability checklist covers the rest of a healthy sending setup.

Got a different bounce? Paste it into the SMTP error code lookup to decode it.

535 5.7.3: Authentication unsuccessful (Microsoft 365)