oAuth support to send emails via Microsoft 365 and Gmail

[venturini-dev]

With Microsoft discontinuing support for SMTP auth in September 2025, many clients using 365 as a mail server are moving towards oAuth to authenticate external apps.
In many cases we had to provide an external SMTP service just to send emails from a Craft CMS site.

It's never nice to have to answer that Craft cannot connect to a mailbox on 365 via oAuth.
This can also be useful for Gmail accounts.

Can you consider adding a transport type that involves oAuth authentication for sending emails via 365 and Gmail?

[winedog]

I think I have just run into this issue myself. When I use Wordpress sites there are plugins available that allow the site to post directly into Gmail using Oauth2.

If you find a solution to this, that would be great. It looks like the only workaround might be to use App Passwords when it comes to Gmail accounts, but this is less than ideal compared to Oauth2.

I've looked for someone who has a 3rd party plug-in for Craft that might solve this issue, but I've yet to identify anything.

[brandonkelly]

We’re still looking into this, but it looks like app passwords are unaffected by Gmail’s upcoming changes per this support article. Those are working in Craft 4 and 5 in our testing.

[TheFunkyMonk]

Is this still being looked into? We have quite a few clients that are using O365 for their SMTP credentials that would need to switch to a different service if there isn't oAuth support available, which would be a lot of overhead for some of them.

[brandonkelly]

We’re keeping an eye on symfony/symfony#52546. It looks like that will get pulled in for Symfony 7.2.

[alexanderbuergin]

@brandonkelly
Is there any update on this topic?

Microsoft will discontinue support for basic SMTP authentication by September 2025 (see SendLayer article).

This affects many Craft CMS users who need to send emails via Microsoft 365. oAuth will become mandatory, and relying on external SMTP services is not a practical long-term solution for most clients.

Questions:
– Is there any news on if or when a dedicated oAuth transport will be implemented in Craft CMS?
– Do you already know how Microsoft’s change will specifically affect Craft CMS installations?
– Can we expect a solution before the deadline?

Thank you for a short update.

[brandonkelly]

I don’t have an update, sorry. We continue to monitor symfony/symfony#52546 and symfony/symfony#48888.

[alexanderbuergin]

Thanks @brandonkelly.