As well as EWS and Remote PowerShell (RPS) other mail protocols POP3, IMAP and SMTP have had OAuth authentication enabled in Exchange Online (Official announcement here). A while ago I created this script that used Opportunistic TLS to perform a Telnet style test against a SMTP server using SMTP AUTH. Now that oAuth authentication has been enabled in office365 I've updated this script to be able to use oAuth instead of SMTP Auth to test against Office365. I've also included a function to actually send a Message.
Invoke-TestSMTPTLSwithOauth -ServerName smtp.office365.com -SendingAddress gscales@datarumble.com -To gscales@datarumble.com -ClientId {your AzureApp Registration Id} -RedirectURI {Your redirect URI}
Invoke-SendMessagewithOAuth -ServerName smtp.office365.com -SendingAddress jcool@somedomain.com -To gscales@somedomain.com -Subject "This is a Test Message" -Body "Test Body" -AttachmentFileName "c:\temp\olm.csv" -userName gscales@datarumble.com -ClientId {your AzureApp Registration Id} -RedirectURI {Your redirect URI}
Token Acquisition
To Send a Mail using oAuth you first need to get an Access token from Azure AD there are plenty of ways of doing this in PowerShell. You could use a library like MSAL or ADAL (just google your favoured method) or use a library less approach which I've included with this script . Whatever way you do this you need to make sure that your application registration https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app has the following permissions scope https://outlook.office.com/SMTP.Send . One thing to note is that Application permissions aren't supported at the moment so you need to use one of the Delegate Authentication flows (which means having a service account for SendAs other user scenarios).
Adding the SASL XOAUTH2 header
This was really the only thing I needed to change in the initial script apart from adding in code to get the OAuth token. The SASL header looks like the following
base64("user=" + userName + "^Aauth=Bearer " + accessToken + "^A^A")
The ^A character is a Control code which relates to character 01 in the ASCII Character set which corresponds to SOH (Start of Heading).
Testing out OAuth
I've put the Script for this post here https://github.com/gscales/Powershell-Scripts/blob/master/TLS-SMTP-Oauth-Mod.ps1
To test out oAuth against Office365 use something like the following
which should give you an output like
Actually Sending a Message
As well as the SMTP Mail Conversation Test function, I also included a function that would allow you to actually send an Email Message using SMTP,TLS and oAuth. As the System.Net.Mail.Message class is now obsolete (which also takes Send-MailMessage along with it in term of sending via oAuth) there is no way of easily sending a Message without a third party library like MailKit (which is actually a really good library and supports things like Dkim etc). To get the Message Send to work I used the System.Net.Mail.Message and then used reflection to substitute a MemoryStream into the Send function so I could get the Message from this class as a MimeStream. This stream can then be sent as part of the SMTP DATA verb (minus the X-Sender/X-Reciever Headers). As mentioned in the Token Acquisition if you want to send as another user you need to have the normal Exchange SendAS permission granted to the Delegate account you using. To Send a Message with an Attachment use something like
Which will produce a conversation like
MailKit
If your reading this post because you have existing code that needs to be converted to use oAuth then the library you want to use in either PowerShell or C# is MailKit . For Powershell I would check out the https://www.powershellgallery.com/packages/Mailozaurr/0.0.9 module that looks pretty good, with C# here is a simple example that use MSAL and MailKit