WordPress, WooCommerce and web-form mailers

The usual problem

A site plugin (or a hosting control panel) is set to send through smtp.office365.com with a mailbox username and password. That is Basic authentication.

Options

  1. A plugin mailer that uses Microsoft's API (OAuth) instead of a password. WP Mail SMTP documents a "Microsoft 365 / Outlook.com" mailer that "securely use[s] Microsoft's API" so "you don't have to enter any sensitive login details into your WordPress admin area". Per that vendor page (updated Jun 29 2026) [A, page read]: - it is a Pro-license feature; - setup is either One-Click Setup (Pro) or registering an app in Microsoft Entra/Azure (App ID + client secret + redirect URI), then authorizing; - the page says Microsoft requires a credit card to create an Azure account and lists client-secret expiry choices (its example: 730 days) [A; we did not test either claim; set a reminder for secret expiry]; - From email must match the authorized account unless send-as is configured (error seen: ErrorSendAsDenied); From Name cannot be forced. Source: https://wpmailsmtp.com/docs/how-to-set-up-the-outlook-mailer-in-wp-mail-smtp/
  2. Microsoft Graph sendMail if you control the code or the plugin supports it: POST /users/{id|upn}/sendMail, permission Mail.Send, a 202 means accepted not delivered [V: https://learn.microsoft.com/en-us/graph/api/user-sendmail?view=graph-rest-1.0].
  3. High Volume Email: only if every recipient is inside your tenant (contact-form notices to staff, yes; order emails to customers, no) [V: HVE page].
  4. A third-party sending service for mail to customers (needs DNS/SPF/DKIM and an account; not evaluated here).
  5. Stopgap: re-enable Basic for that mailbox after the default flips (Set-CASMailbox -Identity <mailbox> -SmtpClientAuthenticationDisabled $false; the mailbox setting overrides the org setting) [V: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission]. Note Security Defaults in Entra block SMTP AUTH regardless [V same page].

What we could not verify