Exchange Online / Outlook.com SMTP: OAuth2 XOAUTH2 send fails with 535 5.7.139 SmtpClientAuthentication is disabled on newly created personal accounts

Service: Outlook.com / Hotmail personal (consumer) accounts, SMTP AUTH via OAuth2 (XOAUTH2), smtp.office365.com:587 + STARTTLS. Node.js backend (Nodemailer), not MailKit.

Scenario: We connect customers' personal Outlook.com/Hotmail mailboxes to our SaaS via OAuth2 (Microsoft Identity Platform, delegated permissions SMTP.Send, IMAP.AccessAsUser.All, offline_access). We use the resulting access token as XOAUTH2 credential to send email over SMTP AUTH. This has always worked for older personal accounts. Starting recently (August 2026) we noticed it consistently fails for mailboxes that were created recently, even though:

• IMAP with the same OAuth2 token works fine (we can read the mailbox).
• The OAuth2 token is valid, non-expired, and has the correct scope (SMTP.Send).
• The account is a personal/consumer account, not part of any Microsoft 365 tenant (so there is no admin/Exchange admin center to change SmtpClientAuthenticationDisabled).

Result: SMTP AUTH is rejected immediately at login with:

535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Mailbox.
Visit https://aka.ms/smtp_auth_disabled for more information.

Environment: Node.js / Nodemailer, smtp.office365.com:587, STARTTLS, SASL XOAUTH2. Reproduced across multiple distinct newly-registered Outlook.com/Hotmail accounts (not tenant/Exchange Online accounts).

Troubleshooting done:

• Confirmed via aka.ms/smtp_auth_disabled docs this normally applies to Exchange Online mailboxes where an admin can flip Set-CASMailbox -SmtpClientAuthenticationDisabled $false — but these are consumer MSA accounts with no such admin surface.
• Found two related threads confirming the same symptom on new personal accounts with no documented fix:
  • https://learn.microsoft.com/en-us/answers/questions/5790786/newly-registered-personal-outlook-email-accounts-c
  • https://learn.microsoft.com/en-in/answers/questions/5904972/consumer-outlook-com-oauth2-imap-works-but-smtp-fa
• Verified this is not an auth-mechanism issue (password vs OAuth2) — the block is at the SMTP AUTH transport level regardless of credential type.

Questions:

1. Is it now Microsoft's confirmed, permanent policy that newly-created Outlook.com/Hotmail personal accounts have SMTP AUTH disabled by default, with no end-user or third-party way to re-enable it — even when authenticating via valid OAuth2/XOAUTH2?
2. Is there any officially supported alternative for third-party apps to send mail on behalf of these consumer mailboxes besides fully migrating to Microsoft Graph sendMail (POST /me/sendMail)? Is Graph guaranteed to remain available/unblocked for consumer (MSA) accounts under this same delegated OAuth2 flow?