title: Outlook 365 OAuth 535 5.7.3 Authentication unsuccessful
body: <p>I'm trying to send an email via smtp.live.com using an OAuth token generated via <a href="https://login.microsoftonline.com/common/oauth2/v2.0/" rel="nofollow noreferrer">https://login.microsoftonline.com/common/oauth2/v2.0/</a>… but I'm receiving the following error:</p>
  
  <pre><code>535 5.7.3 Authentication unsuccessful
  </code></pre>
  
  <p>I can make it work by obtaining an auth token via <a href="https://login.live.com/oauth20_authorize.srf" rel="nofollow noreferrer">https://login.live.com/oauth20_authorize.srf</a> (a legacy API) but that only works for free Microsoft accounts (I need to support business/Outlook365 accounts too).</p>
  
  <p>The fact I can make it work using that legacy endpoint seems to validate that:</p>
  
  <ul>
  <li>The server supports <code>XOAUTH2</code> (which I also validated via Telnet <code>EHLO</code>)</li>
  <li>That the encoding is correct (I'm using <a href="https://github.com/andris9/xoauth2/blob/master/src/xoauth2.js#L178" rel="nofollow noreferrer">this process</a>)</li>
  <li>That I'm meant to pass the full access token via <code>XOAUTH2</code> and not something odd like pass it in via <code>LOGIN</code>, or decode the JWT and pass in some component etc.</li>
  </ul>
  
  <p>The access token seems valid (it works for other calls, including sending an email via the Graph API).</p>
  
  <p>I've requested the following scopes:</p>
  
  <pre><code>[
    'offline_access', 'User.Read', 'MailboxSettings.ReadWrite',
    'Mail.Send', 'Mail.ReadWrite', 'Mail.Read', 'Mail.ReadBasic', 'Contacts.ReadWrite',
    'Mail.Read.Shared', 'Mail.ReadWrite.Shared', 'Mail.Send.Shared', 'MailboxSettings.Read',
    'profile', 'openid', 'email', 'Calendars.ReadWrite',
    'EAS.AccessAsUser.All', 'EWS.AccessAsUser.All',
  ];
  </code></pre>
  
  <p>For the legacy token (the one which works), the scopes are different:</p>
  
  <pre><code>[
    'wl.emails', 'wl.offline_access', 'wl.imap'
  ];
  </code></pre>
  
  <p>(I've tried including these scopes when requesting the v2 token too, but it's invalid).</p>
  
  <p>Other things I've tried:</p>
  
  <ul>
  <li>Using smtp.office365.com instead of smtp.live.com</li>
  <li>Obtaining fresh access tokens</li>
  <li>Ensuring app settings/permissions are configured correctly, as per <a href="https://www.emailarchitect.net/easendmail/sdk/?ct=object_oauth_live" rel="nofollow noreferrer">this article</a></li>
  <li><a href="https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online" rel="nofollow noreferrer">Enable Exchange SMTP Auth</a></li>
  </ul>