Secure OAuth-Based Email Integration with Office 365 SSO in BizTalk360

Key Takeaways

• Why modern authentication matters and how it improves security.
• How BizTalk360 securely handles user sign-in and email communication through Office365 SSO.
• Seamless OAuth token management and auto-reauthentication for uninterrupted notification.

Why we Introduced Office365 SMTP Support in BizTalk360

One of the key reasons we have introduced Office365 SMTP support in BizTalk360 was due to Deprecation of Basic authentication in Exchange Online across Office365 services. BizTalk360 relied on Basic Authentication to send email notifications, which involved using a username and password to authenticate with the SMTP server.

Although BizTalk360 secures these credentials using encryption, the underlying Basic Authentication model still carries security limitations:

• It provides no protection against credential replay attacks once the username and password are compromised.
• Static credentials make it harder to enforce modern security measures like Multi-Factor Authentication (MFA) or conditional access policies.

To enhance the overall security posture of its cloud services, Microsoft announced the retirement of Basic Authentication for protocols such as SMTP, POP, IMAP, and Exchange Web Services, mandating the use of Modern Authentication (OAuth2).

OAuth2 is a more secure, token-based authentication mechanism that eliminates the need for static credentials. By adopting Office365 SMTP with OAuth2, BizTalk360 ensures seamless and secure email delivery while staying fully aligned with Microsoft’s modern authentication standards.

Understanding How Office365 SSO and Modern Authentication Works

Modern Authentication in Office365 is built on the OAuth2 and OpenID Connect protocols, leveraging Azure Active Directory (AAD) for secure user and application identity management. This mechanism replaces the traditional username-password model with a secure, token-based approach that ensures authentication and authorization are handled without exposing user credentials.

To obtain the necessary tokens from Azure Active Directory (Azure AD), the login process must be completed using the Microsoft login and consent page. During this step, the user must grant consent for the application to send emails on behalf of the configured email address. Once the login and consent process is successfully completed, Azure AD issues two key tokens to the application:

• Access Token – A short-lived token (typically valid for 1 hour) used to authenticate with SMTP server when sending emails. Instead of storing or transmitting credentials, the application includes this token in the authorization header for each mail request.
• Refresh Token – A long-lived token (usually valid for up to 90 days, depending on the organization’s policy) that allows the application to silently acquire a new Access Token once the current one expires, without requiring user reauthentication.

These tokens are securely retrieved from Azure AD’s token endpoint during the authentication flow and are encrypted and stored in the application’s database. Whenever the Access Token expires, the Refresh Token is used to request a new one from Azure AD, ensuring continuous and secure email communication.

This token-based mechanism enhances security and provides a seamless, password less experience aligned with Microsoft’s Modern Authentication standards.

Inside Look: How BizTalk360 Connects with Office365 SMTP OAuth

To ensure seamless and secure email communication, BizTalk360 integrates deeply with Office365 OAuth2-based authentication. This modern approach eliminates dependency on static credentials and ensures continuous email delivery through secure token management. The complete configuration involves below key components working together.

1. BizTalk360 Portal

In the BizTalk360 portal, users can switch to the new OAuth (Office 365) login type and save the configuration. Once OAuth is selected, the portal displays the steps required to complete the configuration, guiding users through the setup process.

After completing the configuration, details such as the admin email, port, and server name are displayed along with the authentication method set to OAuth2.

2. Authenticator App

To complete the SMTP setup, users must run the Kovai.BizTalk360.SMTPAuthenticator.exe, which is available on machines where the Monitoring Service is installed. Office 365 button appears in the app. Clicking this button triggers the Microsoft login dialog, where the user completes multi-factor authentication (MFA) or standard login. After successful login, the app sends a test email to verify the configuration. If the test succeeds:

• Access and Refresh Tokens are securely stored in the BizTalk360 database as a token cache.
• The SMTP configuration is updated successfully in the system.

The authenticator app also supports proxy settings. If gateway setting is configured in BizTalk360, those settings are automatically displayed. Otherwise, users can manually provide the settings before clicking the Office 365 button.

3. Monitoring Service

Once the login and authentication are completed successfully, the Monitoring sub-service takes over to manage token lifecycle and email delivery.

• The service regularly checks the expiry of the access token.
• Just before the access token expires, it uses the Refresh Token stored in the BizTalk360 database to obtain a new Access Token automatically.
• If token refresh fails, an error is displayed in the portal and recorded in the BizTalk360 logs for troubleshooting.

The refreshed token is then used for all subsequent email communications, ensuring continuous, secure, and reliable delivery without user intervention.

Note on “No-Reply” Mailboxes

When using OAuth2 authentication, the access token is tied to a specific mailbox identity usually the account used during the consent and authentication process. As a result, attempting to change the from address to another mailbox (noreply@system.com) can lead to permission errors such as:

To overcome this challenge, email templates in BizTalk360 are migrated to the logged-in user’s email address as the from address.

Benefits and Considerations of Using Office365 SMTP

Integrating Office365 SMTP with OAuth2 authentication in BizTalk360 brings several advantages:

• Enhanced Security – No passwords are stored or transmitted; tokens are securely managed and encrypted.
• Compliance with Microsoft’s Security Standards – Aligns with Microsoft’s deprecation of Basic Authentication.
• Support for Modern Authentication Features – Works seamlessly with MFA and conditional access policies.
• Improved Reliability – Automatic token renewal ensures continuous email functionality.

Enhanced Email Integration with SMTP OAuth and MailBee

With the introduction of SMTP OAuth2 support, several key features including Monitoring, Analytics, and Send as Email (from the BizTalk360 Portal) now leverage secure, modern authentication for all email communications.

In addition, MailBee a robust and high-performance .NET email library, has been completely integrated into BizTalk360 to handle all email operations. This enhancement improves efficiency, boosts reliability, and ensures seamless management of OAuth-based SMTP connections across every mail-enabled feature.

Conclusion

With Microsoft’s move to modern authentication, adopting Office365 SMTP support with OAuth2 in BizTalk360 keeps users compliant, secure, and future-ready. This update removes the risks of Basic Authentication and ensures reliable, consistent email communication across all BizTalk360 features.

To know more about the BizTalk360 features, try out the free trial or book a demo.