How to configure SMTP using Microsoft Graph (OAuth 2.0) for email notifications in the SolarWinds Platform 2025.2 and above

3/6/2026 4:18 PM

3/6/2026 4:18 PM

Microsoft has officially announced that on October 1, 2026, EWS requests to Exchange Online will be blocked. Additionally, Microsoft is retiring Basic Authentication for SMTP Client Submission (SMTP AUTH) in Exchange Online, with enforcement beginning March 2026 and reaching 100% rejection by April 30, 2026.

If you are currently using EWS OAuth 2.0 or Basic Authentication for SMTP in the SolarWinds Platform, you must migrate to Microsoft Graph before these deadlines to avoid email notification failures.

The Microsoft Graph SMTP client option is available starting with SolarWinds Platform 2025.2.

Why Microsoft Graph over EWS?

Capability	EWS OAuth 2.0	Microsoft Graph
Permission model	full_access_as_app (broad, tenant-wide)	Mail.Send (least-privilege, scoped)
Mailbox scoping	Not natively supported	Application Access Policies limited to specific mailboxes
Microsoft investment	Deprecated — blocked Oct 2026	Actively maintained and recommended
Security posture	Higher blast radius if credentials are compromised	Reduced blast radius with granular permissions
Conditional Access & audit	Limited	Full integration with Entra ID Conditional Access and audit logs

 

Orion Platform

Microsoft is deprecating legacy authentication methods for Exchange Online:

• Basic Authentication (username/password) for SMTP AUTH retired March–April 2026.

• Exchange Web Services (EWS) blocked October 1, 2026.

Applications must migrate to OAuth 2.0 with Microsoft Graph API to continue sending email notifications through Exchange Online.

Reference: Retirement of Exchange Web Services in Exchange Online

Step 1: Register your application in Microsoft Entra ID

1. Open a browser and navigate to the Microsoft Entra admin center. Log in with an admin account.

2. Navigate to Identity → Applications → App registrations.

3. Click + New registration.

4. Configure the registration:

   • Name: Enter a friendly name (e.g., SolarWinds-SMTP-Graph).

   • Supported account types: Select the option appropriate for your organization (typically Accounts in this organizational directory only).

   • Redirect URI: Set to Public client (mobile & desktop) and enter:

     https://login.microsoftonline.com/common/oauth2/nativeclient
     

5. Click Register.

6. On the Overview page, copy and save:

   • Application (Client) ID

   • Directory (Tenant) ID

 

Step 2: Configure API permissions (Mail.Send)

1. In the app registration, go to API permissions under Manage.

2. Click + Add a permission → Microsoft Graph → Application permissions.

3. Search for Mail.Send and select it.

4. Click Add permissions.

5. Click Grant admin consent for [your organization] and confirm.

Note: Unlike EWS, which required full_access_as_app, Microsoft Graph uses the granular Mail.Send permission. This significantly reduces the security blast radius.

Step 3: Create a Client Secret

1. Go to Certificates & secrets under Manage.

2. Click + New client secret.

3. Enter a description and select an expiration period.

4. Click Add.

5. Copy the Secret Value at this step as it will not be shown again.

Step 4: Limit application permissions to specific mailboxes (recommended)

Following Microsoft best practices, restrict the app to send only from approved mailboxes:

1. Create a mail-enabled security group in Exchange Online containing the mailbox(es) the app should send from.

2. Connect to Exchange Online PowerShell:

   Install-Module -Name ExchangeOnlineManagement
   Import-Module ExchangeOnlineManagement
   Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com
   

3. Create an Application Access Policy:

   New-ApplicationAccessPolicy -AppId "<Your_Client_ID>" `
       -PolicyScopeGroupId "<security_group_email>" `
       -AccessRight RestrictAccess `
       -Description "SolarWinds SMTP Graph - restricted to approved mailboxes"
   

4. Test the policy:

   Test-ApplicationAccessPolicy -Identity "<mailbox_email>" -AppId "<Your_Client_ID>"
   

   Expected result: Granted for mailboxes in the group, Denied for all others.

Reference: Limiting application permissions to specific Exchange Online mailboxes — Microsoft Graph | Microsoft Learn

Step 5: Configure Microsoft Graph in the SolarWinds Platform Web Console

1. Log in to the SolarWinds Platform Web Console as an administrator.

2. Navigate to Settings → All Settings → Manage SMTP Servers.

3. Click Add SMTP Server.

4. In the SMTP Client dropdown, select Microsoft Graph.

5. Enter the following values:

   • Application (Client ID): The Client ID from Step 1.

   • Directory (Tenant ID): The Tenant ID from Step 1.

   • Client Secret: The secret value from Step 3.

6. Click Send Test Email to verify the configuration.

7. Click Save.

Step 6: Remove legacy EWS configuration (if applicable)

If you previously used EWS OAuth 2.0:

1. After confirming Microsoft Graph is working, go back to Manage SMTP Servers.

2. Remove or disable the old EWS OAuth 2.0 SMTP server entry.

3. In Microsoft Entra ID, remove the full_access_as_app permission from the old EWS app registration (or delete the old app registration entirely if it is no longer needed).