Splunk Enterprise

Setting outlook.com as SMTP server for Splunk

phamanh1652
Engager

Hello All,

My company is using Outlook (M365 Business Standard). I want to use this Outlook as SMTP server for Splunk. Here is the information for Outlook. POP, IMAP, and SMTP settings for Outlook.com - Microsoft Support

SMTP server name

smtp-mail.outlook.com

SMTP port

587

SMTP encryption

STARTTLS

Authentication Method

OAuth2/Modern Auth

As this link from Microsoft, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 ...

Client SMTP submission using Basic authentication in Exchange Online is scheduled for deprecation in September 2025. And for replacement, High Volume Email for Microsoft 365 is a suitable option, but it relates app password and token, which is not supported in Server settings > Email settings in Splunk.

phamanh1652_0-1741577564229.png

Does Splunk support SMTP server using outlook.com? Could anyone please provide guide for using outlook.com as SMTP server?
FYI: Splunk Enterprise, Version: 9.1.0.2

And if we use Splunk Cloud, is it easier for using outlook.com as SMTP server?

Labels (1)
0 Karma
1 Solution

livehybrid
Super Champion

Hi @phamanh1652 

Splunk Cloud has the same SMTP authentication limitations as Splunk Enterprise. Moving to Splunk Cloud would not solve this particular authentication challenge. Infact, it currently isnt possible to configure your own SMTP server in Splunk Cloud - it cannot be changed.

In terms of the app password / token - Unfortunately this is a change by Microsoft which is a non-standard SMTP implementation. Splunk does not currently support this approach. There are a couple of options here, post-September you may need to use a customised Alert Action to send emails for you using the Office365 API, however this will only work for alerts - it wouldnt work for things like automatic PDF emailing etc.

Another options is to use an external SMTP service or relay service such as SMTP2Go.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

View solution in original post

livehybrid
Super Champion

Hi @phamanh1652 

Splunk Cloud has the same SMTP authentication limitations as Splunk Enterprise. Moving to Splunk Cloud would not solve this particular authentication challenge. Infact, it currently isnt possible to configure your own SMTP server in Splunk Cloud - it cannot be changed.

In terms of the app password / token - Unfortunately this is a change by Microsoft which is a non-standard SMTP implementation. Splunk does not currently support this approach. There are a couple of options here, post-September you may need to use a customised Alert Action to send emails for you using the Office365 API, however this will only work for alerts - it wouldnt work for things like automatic PDF emailing etc.

Another options is to use an external SMTP service or relay service such as SMTP2Go.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...