Configuring OAuth Authorization Code for Microsoft Exchange Online Email in FME Flow

Introduction

FME Flow 2026.3 and later can send email through Microsoft Exchange Online. It uses the OAuth 2.0 Authorization Code flow with Proof Key for Code Exchange (PKCE). One sign-in on the Microsoft consent page gives FME Flow permission to send email. FME Flow stores the tokens it receives instead of a password, and renews the tokens automatically.

We recommend this method for two reasons. First, Microsoft is retiring Basic Authentication for SMTP AUTH in Exchange Online. It is turned off by default for existing tenants from the end of December 2026. Microsoft will announce a final removal date in the second half of 2027. Second, this method works with accounts protected by multi-factor authentication (MFA).

The new method is available everywhere FME Flow sends email: System Email (alerts and password-reset emails), Automations (the Email external action, Send an Email), and Notifications (Email subscriptions).

Authentication method	Status in 2026.3	Password stored in FME Flow	Works with MFA
OAuth Authorization Code (Microsoft)	New, recommended	No	Yes
OAuth Password Grant (Microsoft)	Supported, discouraged	Yes	No
Basic Authentication	Supported in FME Flow. Microsoft turns it off by default at the end of December 2026.	Yes	No

Requirements

You need the following before you start:

FME Flow 2026.3 or later. You do not need to install anything else.
A Microsoft 365 / Exchange Online mailbox that FME Flow will send from. MFA-enabled accounts are supported.
Permission to register an application in Microsoft Entra ID, or an Entra ID administrator who can do it for you.
The FME Flow web URL that users open in a browser, for example https://fmeflow.example.com. You need this URL to build the redirect URI.
SMTP AUTH must be allowed in the Microsoft tenant. If security defaults are turned on in Microsoft Entra ID, SMTP AUTH is turned off. You cannot turn it on for individual mailboxes.

Step-by-Step Instructions

This article has four parts. Part 1 registers an application in Microsoft Entra ID. Part 2 connects FME Flow to Microsoft. Part 3 configures each area that sends email. Part 4 migrates an existing configuration.

Part 1: Register an Application in Microsoft Entra ID

FME Flow needs an Entra ID application (an OAuth client) to request tokens for the sending mailbox. One app for each FME Flow deployment is enough. You can reuse the app for System Email, Automations, and Notifications.

1. Open the App Registrations Page

2. Complete the Registration Form

Complete the registration form with the following settings:

Name: FME Flow Email
Supported account types: Single tenant only - <your tenant> (Choose the account types that can use this application or access this API. This article uses Single tenant only as an example. Use this option if the target audience is internal to your organization.)
Redirect URI:
- Platform: Web
- URL: <https://fmeflow.example.com>/fmeoauth
  - Use your FME Flow URL followed by /fmeoauth. The URL must match exactly how users open FME Flow in the browser: scheme, host name, and port.

3. Copy the Application ID

Click Register. On the Overview page, copy the Application (client) ID.

4. Create a Client Secret

Go to Certificates & secrets > Client secrets > New client secret. Add a description and an expiry, then click Add. Copy the secret Value right away. Microsoft shows it only once.

5. Add API Permissions

Go to API permissions > Add a permission > Microsoft Graph > Delegated permissions. Add the SMTP.Send and offline_access permissions.

6. Grant Admin Consent

Click Grant admin consent for <your organization>.

Record the client secret’s expiry date. When it expires, create a new secret, enter it in FME Flow, and click Sign in with Microsoft again.

Part 2: Connect FME Flow to Microsoft

The email settings look the same in System Email, Automations, and Notifications. This part uses the Email external action in an automation as an example. Part 3 explains where to open the email settings for each area.

1. Set the SMTP Connection

Open the email settings for the area you are configuring. You can use Load Template to fill in some of these fields. Set the following:

SMTP Server: smtp.office365.com
SMTP Server Port: 587
Connection Security: StartTLS
SMTP Account: The email address of the sending Microsoft mailbox

2. Set the SMTP Authentication

In SMTP Authentication, click OAuth Authorization Code (Microsoft). The SMTP Password field disappears and a Microsoft OAuth Authorization section appears.

3. Enter the Client Credentials

Enter the Client ID and Client Secret from Part 1. The Sign in with Microsoft button becomes available.

Client ID: <The Application (client) ID from Part 1>
Client Secret: <The secret Value from Part 1>

4. Open the Microsoft Sign-In Window

Click Sign in with Microsoft. A Microsoft sign-in window opens. If your browser blocks the window, allow pop-ups for the FME Flow site.

5. Authorize the Mailbox

6. Confirm the Authorization

Confirm that the window closes and FME Flow shows Successfully Authorized. The Access Token, Refresh Token, and Access Token Expiry fields fill in. They are masked and read-only.

7. Set the Email From Address

Set Email From to the sending mailbox address, or to an address that the mailbox is allowed to send as.

8. Save and Test the Configuration

Click Save, then click Validate to check for potential issues. Trigger the Email external action to send a test email. Confirm that the email is delivered.

You do not enter a password at any point. FME Flow stores the tokens securely and never shows them in plain text.

Part 3: Configure Each Area That Sends Email

Repeat Part 2 to configure Microsoft Exchange Online email for additional automations, FME Flow system email, or notifications (legacy). Each area keeps its own authorization, so you sign in once for each area.

System Email

Go to System Configuration > Network & Email. Under Email Settings, click Load Template and click Microsoft 365. Then, in SMTP Authentication, click OAuth Authorization Code (Microsoft).

Complete Part 2, then click Send Test Email.

To send password-reset emails this way, enable Password Reset. Request a password reset for a test user and confirm that the email arrives.

Automations (Email External Action)

Open the automation and click the Email external action (Send an Email), or add a new one. Complete Part 2 in the action parameters, then click Validate. Save and enable the automation. Trigger it and confirm that the email arrives.

FME Flow refreshes the access token automatically while the automation runs. The automation keeps sending after you disable and re-enable it. You do not need to sign in again.

Notifications (Email Subscription)

Go to Notifications > Subscriptions. Create or edit a subscription that uses the Email protocol. Complete Part 2, then click Send Test Email.

Assign the topics you want and save the subscription. Confirm that the email arrives when a topic fires. You do not need to sign in again.

Part 4: Migrate an Existing Basic or OAuth Password Grant Configuration

Existing Microsoft email configurations keep working after you upgrade to FME Flow 2026.3. You can switch them to OAuth Authorization Code in place. You do not need to rebuild the automation, subscription, or system settings.

Upgrade to FME Flow 2026.3 or later. Confirm that the existing email configuration still sends.

Register the Entra ID app (Part 1) if you have not already. If you used an app for OAuth Password Grant, you can reuse it. Add the Web redirect URI and a client secret. Make sure the app has admin consent for the User.Read, SMTP.Send, and offline_access permissions.

Open the existing email configuration. Change SMTP Authentication to OAuth Authorization Code (Microsoft). Leave the server, port, and SMTP Account as they are. Enter the Client ID and Client Secret, click Sign in with Microsoft, then save and test. Follow steps 3–8 in Part 2.

If you change the method back to Basic Authentication, FME Flow removes the stored OAuth tokens. To use OAuth again later, you must sign in again.

Troubleshooting

If Sign in with Microsoft fails or the test email is not delivered, check the following first.

Check the redirect URI and the client secret. The redirect URI in the Entra ID app must match exactly how users open FME Flow in the browser: scheme, host name, and port. Also confirm that the client secret has not expired. If it has expired, create a new secret, enter it in FME Flow, and click Sign in with Microsoft again.

If the problem continues, contact Safe Software Support. Include the FME Flow version and build number, the affected area (System Email, Automations, or Notifications), the exact error message, and the time the error happened. Also include the relevant FME Flow logs from that time, such as fmeserver.log and the Automations or Notifications logs.

Search