Hello,

We use:
DO wwSmtp
LOCAL loSmtp as wwSmtp
loSmtp = CREATEOBJECT("wwSmtp")
loSmtp.nMailMode = 0 && .NET 2 - classic (default)
loSmtp.nTimeout = 25
loSmtp.lUseSsl = .T.
loSmtp.cMailServer = "smtp.office365.com"
loSmtp.cUsername = "Re@BvL123.com"
loSmtp.cPassword = "123"
loSmtp.cSenderName = "Re@BvL123.com"
loSmtp.cSenderEmail = "Re@BvL123.com"
loSmtp.cSubject = "BvLArchivio DMS neue Vorgänge"
loSmtp.cRecipient = lc_umail
loSmtp.cAttachment = ""
loSmtp.cMessage = "Hallo "

Microsoft has announced that basic authentication for SMTP in Microsoft 365 will no longer be supported starting in September 2025. This discontinuation affects a wide range of applications and devices that send emails via the SMTP endpoints smtp.office365.com and smtp-legacy.office365.com.

Can we get an alternative? For example, OAuth 2.0 or other modern authentication methods?

Best regards Ralph von Loesch

Nope not through this library. The complexities of using SMTP with one of these services are too many to automate easily - it requires token authentication (either an Azure 365 account or manual browser window authentication) which is beyond the scope of any SMTP library. It's not too bad to implement in Web applications, but for desktop apps it requires some sort of browser interface to handle the oAuth flow in addition to the library (ie. it's not fully automated in the first place).

Frankly the only realistic way to handle SMTP sending inside of an application these days is through one of the mail API Services available (Twilio, Mailgun etc.) which have either APIs or work through SMTP/IMAP/POP3. If you have a Microsoft 365 server then you can also go through their mail APIs (Microsoft Graph) but these are not generic (ie. MS, Google, Apple etc all have different internal APIs) and also quite complex due to the auth requirements.

Per user email sending inside of a desktop application is pretty much a thing of the past - delegation through a centralized service, or pre-filling email messages perhaps via mailto: protocol and letting the client's default email client handle actual sending, is the only thing that's realistic anymore.

Ironically these things are done to presumably prevent abuse, and yet SPAM is on the rise and of course the real purveyors of this crap aren't bound by these restrictions using their own servers to spam the world.

It's a supreme example of gatekeeping and herding people into a few limited and very complex solutions to solve simple problems.

+++ Rick ---

Okay, thank you very much for this information. And OAuth 2.0 also requires re-authentication after 90 days if it's not used regularly. So, it's an effort that's completely pointless for machines, etc. We'll move away from Office 365 then.

Best regards Ralph von Loesch