Setting outlook.com as SMTP server for Splunk

[phamanh1652]

Hello All,

My company is using Outlook (M365 Business Standard). I want to use this Outlook as SMTP server for Splunk. Here is the information for Outlook. POP, IMAP, and SMTP settings for Outlook.com - Microsoft Support

SMTP server name	smtp-mail.outlook.com
SMTP port	587
SMTP encryption	STARTTLS
Authentication Method	OAuth2/Modern Auth

As this link from Microsoft, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 ...

Client SMTP submission using Basic authentication in Exchange Online is scheduled for deprecation in September 2025. And for replacement, High Volume Email for Microsoft 365 is a suitable option, but it relates app password and token, which is not supported in Server settings > Email settings in Splunk.

Does Splunk support SMTP server using outlook.com? Could anyone please provide guide for using outlook.com as SMTP server?
FYI: Splunk Enterprise, Version: 9.1.0.2

And if we use Splunk Cloud, is it easier for using outlook.com as SMTP server?

[livehybrid · Accepted solution]

Hi @phamanh1652 

Splunk Cloud has the same SMTP authentication limitations as Splunk Enterprise. Moving to Splunk Cloud would not solve this particular authentication challenge. Infact, it currently isnt possible to configure your own SMTP server in Splunk Cloud - it cannot be changed.

In terms of the app password / token - Unfortunately this is a change by Microsoft which is a non-standard SMTP implementation. Splunk does not currently support this approach. There are a couple of options here, post-September you may need to use a customised Alert Action to send emails for you using the Office365 API, however this will only work for alerts - it wouldnt work for things like automatic PDF emailing etc.

Another options is to use an external SMTP service or relay service such as SMTP2Go.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will