04-20-2022 11:50 AM - edited 04-20-2022 11:51 AM
I was really struggling to configure SMTP with M365. We have a distribution list that our Operations team are all apart of and wanted to receive email notifications from Jamf for a variety of reasons.
Our environment has MFA enabled and I was continuously fighting with both Jamf/Azure to figure out a workaround to the authentication errors I was seeing in the Jamf Server Logs.
It wasn't until after creating a service account without MFA applied it(account being authenticated in Jamf SMTP) and enabling "Send As" and "Send on behalf" in the distribution list by adding the service account to the delegates list that mail was delivered.
Lets look at a couple server logs I was experiencing first.
Server Log Error generated from an account with MFA enabled:
With the error above I messed around in Azure quite a bit and got no where. I made exceptions with my user for MFA and I attempted trying to configure an "App Password" which doesn't seem to exist anymore? Or at least was not available within my users account settings for some reason.
Server log Error generated from authenticating with a service account created in M365 with no MFA enabled.
The "SendAsDenied" stuck out to me and I remembered in Exchange that you could configure an account to "Send As". It wasn't until after enabling the service account (account being authenticated in Jamf SMTP) to send as the distribution list that I was targeting mail was finally delivered.
Below is the configuration / solution which allowed for mail to be delivered successfully from Jamf Pro to our M365 Server using a service account without MFA.
Microsoft 365 Configuration:
Step 1: Navigate to admin.microsoft.com
Step 2: Users > Active Users > Add a User
Step 3: Navigate to Exchange Online Admin Center from M365 Admin Center.
Step 4: Navigate to Recipients > Groups > Distribution List and locate the Distribution List you want to target.
Step 5: Select the Distribution List > Settings > Manage Delegates > Edit Delegates > Add a delegate > Add the service account you created and choose the “send on behalf” option. Save changes.
Jamf Pro Configuration:
Step 1: Sign into your Jamf Cloud Instance
Step 2: Select the Settings cog in the top right
Step 3: Navigate to System Settings > SMTP Server
Step 4: Enter the following information:
Step 5: Save and Test. At this point I received an email.
Note: This is how I accomplished this, it may not work for your environment. If you think I skipped a step or didn't explain something clearly please let me know and I'll take a look.
Posted on 04-27-2022 01:02 AM
Thank you for your guide, I keep getting: javax.mail.AuthenticationFailedException: 535 5.7.139 Authentication unsuccessful, basic authentication is disabled. [AS8PR07CA0033.eurprd07.prod.outlook.com]
This not working for me: Disable Basic authentication in Exchange Online | Microsoft Docs
Posted on 06-23-2022 11:06 PM
it was a time issue, it work for me now
Posted on 06-03-2022 07:19 PM
Foe Me Its work First time only Not sure why But its working
"A test message was successfully sent."
Posted on 07-11-2022 12:37 PM
Can anyone here get the "Sender Display Name" to work? I've got the emails working fine, but I never get the Sender Display Name to use what I have entered, and it's confusing as I have a bunch of Jamf servers...
Posted on 07-11-2022 01:52 PM
Mine Work fine
Posted on 08-26-2022 12:52 AM
Hi, it's not working! I tried this:
- Created an user in Outlook
- Enabled SMTP Auth for that user mailbox.
- smtp.outlook365.com | 587
- TLS1.2 and connection timeout 15sec
Added username (email) and password
Posted on 08-26-2022 12:55 AM
try use your EOP on port 25
Posted on 08-26-2022 01:14 AM
I tried this not working.
Posted on 08-26-2022 01:18 AM
I do this, but look your log
Posted on 08-26-2022 01:02 AM
I tried this not working.
Posted on 08-26-2022 10:22 AM
Odd, this was working until the 10.40.1 update...now it's not. This sucks!
Posted on 08-29-2022 01:29 PM
Well, this may be part of what we're seeing...we recently changed our auth to modern using OKTA verify, so we'll have to see if we can make changes or change to another email solution for this:
Basic Authentication Deprecation in Exchange Online – May 2022 Update